nice to know that microsoft doesn't bounty CVSS >6 bugs that require user interaction. a proof of concept doing stuff like sandbox escapes, clipboard reading, mic access etc without consent is apparently "low severity" :) just sell your vulns to the highest bidder, MSRC is a scam
also now that im sure that i will not get paid, i'll release all details publicly soon. in the meantime: please, for the love of god, do not use microsoft edge (or other MS stuff), because their engineers did not even bother to read the chromium/upstream UI security documentation
