When using Chrome and I select a file for upload on a website that accepts files, a Windows dialog box appears for me to select a file.
I can then paste a URL address for a file in the dialog box, and explorer.exe then invokes a process to download the file to a temporary folder, and then upload the file from the temporary folder to the website.
I think explorer.exe invokes Edge, judging by the temporary files location of subsequent upload dialog boxes remembering the last used folder.
Can a maliciously encoded url use a malformed 'filename' (what windows interprets) in the url to somehow impact the explorer.exe process or Windows filesystem nefariously?
Can this access be contained within Edge's browser cache or can it go further with a carefully designed filename?
Once the filename becomes local, is the process running with local zone privileges?