CVE-2026-109559 in EdgeEver
Summary
by MITRE • 10/13/2026
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in EdgeEver Desktop versions 1.6.26 through 1.112.0 represents a critical security flaw rooted in improper validation of navigation allowlists within the application's web view implementation. This issue specifically affects how the desktop client processes URL inputs for loading content into its main window, which serves as the primary interface for user interaction and data display. The core technical deficiency lies in the mechanism used to verify whether a requested origin is permitted by the security policy. Instead of performing strict domain matching or parsing the Uniform Resource Identifier (URI) components correctly before validation, the application relies on simple string-prefix matching against an allowlisted prefix associated with its development server. This approach fails to account for the structural nuances of URIs, particularly those containing userinfo segments, which are defined by RFC 3986 as appearing between the authority and path sections of a URL.
By exploiting this logic error, an attacker can craft malicious URLs that appear to match the allowed prefix while actually pointing to arbitrary external origins. The exploitation vector typically involves embedding such a link within content rendered by the application, such as in note-template previews or other user-generated text fields. When a victim clicks on or triggers the loading of this crafted URL, the browser engine interprets the userinfo syntax—specifically the @ symbol followed by credentials—to separate the host from the path. The security check sees that the string begins with the trusted prefix and grants access, unaware that the actual destination is an untrusted external domain controlled by the attacker. This bypass effectively neutralizes the intended isolation between the application's internal privileged context and external web content.
The operational impact of this vulnerability is severe due to the high level of privileges granted to the main window process in Electron-based applications like EdgeEver Desktop. Once arbitrary origins are loaded, an attacker gains access to sensitive interfaces that should remain restricted to local resources. Specifically, the exploit allows interaction with the edgeeverDesktop bridge, which facilitates communication between the web content and the native host application. Through this bridge, attackers can retrieve session tokens used for authentication, thereby compromising user accounts without needing valid credentials. Furthermore, access is gained to sidecar RPC channels and Access Control Policy (ACP) channels, enabling remote code execution capabilities or unauthorized manipulation of local files and system settings depending on the specific permissions granted by these interfaces.
This vulnerability aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate user-supplied input before processing it for navigation decisions. It also maps directly to MITRE ATT&CK technique T1536 Potential Double Encoding, although in this case, the double encoding is not strictly required but rather a misinterpretation of URI syntax components like userinfo that allows bypassing simple string checks. The flaw exemplifies the risks associated with naive URL parsing strategies where structural integrity is assumed without rigorous component-level validation.
Mitigation for this vulnerability requires immediate updates to EdgeEver Desktop software, as patches have been released in versions subsequent to 1.112.0 to correct the allowlist logic. For organizations unable to patch immediately, restricting user input fields that render HTML or links can reduce exposure. Additionally, implementing Content Security Policy (CSP) directives within the application's web views can provide a secondary layer of defense by strictly defining which sources are permitted for loading resources and executing scripts. Developers should also adopt robust URI parsing libraries rather than relying on string manipulation functions to validate origins, ensuring that scheme, host, port, and userinfo components are parsed individually against security policies before any navigation occurs.