CVE-2026-109556: EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs the ability to execute script in an EdgeEver Desktop renderer. The described paths include stored cross-site scripting in template-preview or drag-preview.
What privileges would launched code have?
The caller-supplied local executable is launched with the privileges of the current EdgeEver Desktop user. This can result in code execution in that user's security context.
Which installations are affected?
EdgeEver Desktop versions 1.92.0 through 1.112.0 are identified as affected. The issue is in the desktop:acp-probe IPC handler.