Pwn2Own Berlin Zero-Days Hit Edge, Windows 11, and AI Platforms

Researchers at Pwn2Own Berlin 2026 earned $523,000 on the first day after demonstrating 24 unique zero-day vulnerabilities against fully patched targets spanning browsers, operating systems, AI platforms, and NVIDIA-related infrastructure. The standout exploit came from Orange Tsai of DEVCORE Research Team, who chained four logic bugs to escape the Microsoft Edge sandbox and collected $175,000. Windows 11 was also successfully compromised three times through separate local privilege-escalation zero-days, underscoring continued risk in core desktop platforms.

Other successful demonstrations targeted Red Hat Linux for Workstations, NVIDIA Container Toolkit, NVIDIA Megatron Bridge, LiteLLM, Chroma, OpenAI Codex, and LM Studio, showing that enterprise AI tooling was a major attack surface at the event. Some attempts, including attacks against Oracle Autonomous AI Database and one OpenAI Codex entry, failed, but AI products still featured prominently as the competition’s enterprise-and-AI theme drove testing. After day one, DEVCORE Research Team led the standings with $205,000, and disclosed bugs now move into the contest’s 90-day vendor remediation window.