CVE-2026-109557: EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP createnotebook, renamenotebook or creatememo tools, running script on drag with access to the desktop bridge's session token.
Affected Software
Event History
Frequently Asked Questions
What level of access and interaction are required for exploitation?
An attacker needs low-privileged access to use the MCP create_notebook, rename_notebook, or create_memo tools. A user must then drag the affected notebook or memo so that the malicious drag preview is rendered.
Which user actions can trigger the payload after malicious content has been stored?
The payload is triggered during a drag operation involving a notebook name or memo title containing injected script. Successful execution can access the desktop bridge's session token.
Which releases are known to be affected?
EdgeEver versions through 1.112.0 are identified as affected. The provided data does not identify the first fixed release.