No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.
As a bonus, they also posted a reverse chain: popping Edge from calc [0].
This entire chain is nothing but a lesson of shame for Microsoft - if you fork a thing, better be prepared to thoroughly understand and review each corner you touch. Or you might miss important cross-references that you should update but that aren't mentioned in comments by the original developers.
As for the "sign in automatically" BS that both Google and Edge push - that can go and die in a hellfire where it belongs.
And it's hard to judge them: I'd also rather focus on real features.
Special casing your domains to be assumed "secure" is exactly how you build vulnerabilities directly into your software.
It's an inevitable result.
Developers aren't aware because they assume a security model where the special casing is disabled.
Wow, this is disturbing on its own
This is disgusting behaviour, RCE chain or not.
> I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)
If you then continued on to read the remainder of the article, you would also discover that there was no AI assistance in this research at all.