CVE-2026-109557 — EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles.…
Published: 2026-10-12 · CVSS: 8.4 · CVSS 4.0
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7