Hackers at Pwn2Own competition exploit combination of bugs in Microsoft Edge, Windows 10, and VMware Workstation to escape virtual machine and compromise host
Dan Goodin / Ars Technica :
Context & Ripple Effects
This 2017 result set a template Pwn2Own has kept repeating: rather than a single flaw, attackers chained a browser bug into Windows 10 and then through VMware Workstation to reach the host machine underneath. The significance is that the hypervisor boundary — the layer enterprises trust to isolate workloads — was shown reachable from a web page.
The pattern held. Two years later, researchers again paired browsers with virtualization targets, including Safari against Oracle VirtualBox and VMware Workstation at Pwn2Own Vancouver 2019, and by the 2022 Vancouver contest organizers were paying out over $800K on day one alone for sixteen zero-days across Microsoft, Ubuntu, and Tesla products.
First-order effects
- Microsoft and VMware face immediate patching pressure on Edge, Windows 10, and Workstation, while enterprise customers running guests on Workstation learn their host can be compromised from inside a VM.
Second-order effects
- Rising payouts in later contests — $270K for Firefox, a VMware client, and Edge in 2019, then $800K-plus on a single 2022 day — push more researchers toward chaining virtualization escapes rather than single-browser bugs.
Third-order effects
- If guest-to-host escapes keep landing at each contest, hypervisor isolation loses its standing as an assumed security boundary, forcing vendors to treat the virtualization layer itself as a primary attack surface worth dedicated bounty budgets.
The trend: Pwn2Own has evolved from one-off browser exploits into a recurring market for chained zero-days that pierce virtualization boundaries, with vendor bounties scaling up to meet it.