CVE-2026-109557: EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview

Q: What level of access and interaction are required for exploitation?

An attacker needs low-privileged access to use the MCP create_notebook, rename_notebook, or create_memo tools. A user must then drag the affected notebook or memo so that the malicious drag preview is rendered.

Q: Which user actions can trigger the payload after malicious content has been stored?

The payload is triggered during a drag operation involving a notebook name or memo title containing injected script. Successful execution can access the desktop bridge's session token.

Q: Which releases are known to be affected?

EdgeEver versions through 1.112.0 are identified as affected. The provided data does not identify the first fixed release.

Published Oct 12, 2026

Updated

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP createnotebook, renamenotebook or creatememo tools, running script on drag with access to the desktop bridge's session token.

Affected Software

1 affected component

EdgeEver EdgeEver<=1.112.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction are required for exploitation?

An attacker needs low-privileged access to use the MCP create_notebook, rename_notebook, or create_memo tools. A user must then drag the affected notebook or memo so that the malicious drag preview is rendered.

Which user actions can trigger the payload after malicious content has been stored?

The payload is triggered during a drag operation involving a notebook name or memo title containing injected script. Successful execution can access the desktop bridge's session token.

Which releases are known to be affected?

EdgeEver versions through 1.112.0 are identified as affected. The provided data does not identify the first fixed release.

CVE-2026-109557: EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview

Affected Software

Event History

Frequently Asked Questions

What level of access and interaction are required for exploitation?

Which user actions can trigger the payload after malicious content has been stored?

Which releases are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access and interaction are required for exploitation?

Which user actions can trigger the payload after malicious content has been stored?

Which releases are known to be affected?