CVE-2026-109559: EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker needs to get a user to interact with an embedded link, such as one placed in a note-template preview. The link uses userinfo syntax after the permitted dev-server prefix to cause the main window to load an arbitrary origin.
What access could an attacker gain after a successful bypass?
A successful bypass can give the attacker’s loaded origin access to the edgeeverDesktop bridge. The described exposed capabilities include the session token, sidecar RPC, and ACP channels.
Which releases are affected?
The affected range is EdgeEver Desktop 1.6.26 through 1.112.0.