And it's hard to judge them: I'd also rather focus on real features.
Special casing your domains to be assumed "secure" is exactly how you build vulnerabilities directly into your software.
It's an inevitable result.
Developers aren't aware because they assume a security model where the special casing is disabled.
No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.
As a bonus, they also posted a reverse chain: popping Edge from calc [0].
What the hell is going on there? Apparently they are spawning new and new and new instances of calc.exe until one random (?) instance is vulnerable to some sort of attack, then they inject some shellcode into it from outside, and manage to trigger it by inputting "1"s until there's an overflow?
Really looking forward to the writeup lol
This is disgusting behaviour, RCE chain or not.
Wow, this is disturbing on its own
This entire chain is nothing but a lesson of shame for Microsoft - if you fork a thing, better be prepared to thoroughly understand and review each corner you touch. Or you might miss important cross-references that you should update but that aren't mentioned in comments by the original developers.
As for the "sign in automatically" BS that both Google and Edge push - that can go and die in a hellfire where it belongs.
But what hapens when there's no Javascript interpreter, i.e., not the so-called "modern" browser
And when the OS is not Windows
The so-called "modern" browser _is_ a "logic bug". It's multiple layers of stupidity if "security" is a goal