Orange Tsai detailed a Microsoft Edge sandbox escape chaining five logic bugs with no memory corruption — patched in Edge 148.0.3967.70.