No, it does not. Here is the next sentence from the article:

"Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website."

Thanks for clarification.

So the key of the hacking is a hardware simulation bug within VMware. It is not a surprise to exploit the security holes in Edge at all.

Edge isn't nearly the security nightmare that Internet Explorer was and runs sandboxed in a similar manner as Chrome so you shouldn't underestimate the impressiveness of that first escape either.

not even close. Just look at the CVE listings for 2016 Chrome vs Edge. Edge: 74 code execution vulnerabilities, Chrome: 2

CVE listings are not a meaningful metric at all for security. What that could reflect is that Edge's bounty program is far more popular than Chrome's. It could mean that Edge is willing to hand out CVEs for uncomfirmed bugs whereas Chrome requires further proof (I am not saying this is the case at all, to be clear).

If.you have another metric please offer it.

I have no reason to believe the metrics are biased. A similar number of issues appear for all browsers . The difference is the type of issue.

Of course you're free to just take it on faith that Edge is more secure because Microsoft says so and that the CVE listings have no purpose being used as a comparison. But for me, without finding some other metric to compare by I'll use this metric until there's a better replacement

> If.you have another metric please offer it.

Evaluating the security of a product is a fairly rigorous task with no clear, objective 'this one is strictly more secure' outcome possible.

> I have no reason to believe the metrics are biased.

I gave you multiple reasons why they could be based on a number of things. Not to mention that they seem flat out wrong - Chrome has dozens of security vulnerabilities patched every month. Maybe they don't create CVEs for all of them?

> Of course you're free to just take it on faith that Edge is more secure because Microsoft says so

I don't take it on their word. I have multiple reasons to believe that Edge is a pretty secure browser - I never said it is more secure than Chrome.

Here is a really solid post, that I felt was particularly unbias, by Justin Schuh, who works for (or is the head of? Can't remember) Chrome's security.

https://medium.com/@justin.schuh/securing-browsers-through-i...

As you can read, they both take fairly different approaches that are hard to compare objectively. Is a sandbox improvement more powerful than a new mitigation technique? Again, impossible to say. As Justin states, they're doing solid work though.

> that the CVE listings have no purpose being used as a comparison.

CVE has nothing to do with comparing the security of products and everything to do with notifying users of that products that they need to patch.

> But for me, without finding some other metric to compare by I'll use this metric until there's a better replacement

"I have no tools to compare, so I will use an arbitrary, incorrect tool to compare"

This is totally faulty logic. CVEs are not a metric for evaluating security and they were never intended for such a thing. If you want to actually evaluate software security it is a serious, real process that requires more discipline than saying "well some numbers that have no meaning should be good enough".

Are there any reasons Edge won't go open source? Avoid too many bugs been found?

You think that Edge is closed source to avoid more bugs being found, but Microsoft also pays 3rd party developers for finding bugs in Edge?

You didn't answer my question at all. Are there any special reasons Edge has not been open sourced yet?

I didn't really understand what your question was, it sounded as if you were trying to imply the reason yourself.

I do not work for Microsoft, I have no insight into their decision making process. I doubt it has to do with security.

The JavaScript engine is open source:

https://github.com/Microsoft/ChakraCore

Given that Chrome runs on many platforms, and Edge one, it makes this even more sobering

This may not fit your preconceptions, but the article is saying that Edge is considered a difficult target for hacking.

Which is a strange preconception for the article to have given

https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

vs

https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

As I said above, CVE listings are a useless metric for measuring safety of a product. High # of CVEs can easily indicate a safer product with a more mature bug bounty program or an attitude of "Assume it's vulnerable, don't require full exploits to prove it".

There is no good information to be drawn from those two links.

I think the key is having all three at once?

The last vm escape is very impressive at its own.