CVE-2026-109559

HighCVSS 8.7

Published: 12/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

Risk Assessment

The risk includes theft of session tokens and access to sensitive communication channels, potentially leading to account takeover or unauthorized actions.

Recommendation

It is recommended to update to a version newer than 1.112.0 and review URL validation mechanisms to prevent navigation allowlist bypass.

Other vulnerabilities in EdgeEver Desktop

CVE-2026-109556High
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS