MajorCritical vulnerability
CVE-2026-109557 (CVSS 8.4)
NVD · officialPublished Oct 12, 2026Risk 37/100
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Technical details
CVSS
8.4
AV:NetworkAC:LowPR:LowUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source