CVE-2026-109559 — EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Atta…
Published: 2026-10-12 · CVSS: 8.4 · CVSS 4.0
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7