MajorCritical vulnerability
CVE-2026-109559 (CVSS 8.4)
NVD · officialPublished Oct 12, 2026Risk 37/100
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Technical details
CVSS
8.4
AV:NetworkAC:LowPR:LowUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source