Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109559EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

High 8.7

In plain English

A high-severity incorrect authorization in EdgeEver from tianma-if. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

Affected products (as reported)

Vendor	Product	Versions
tianma-if	EdgeEver	1.6.26 – through 1.112.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GitHub Issue #536 issue-tracking
GitHub Issue #546 issue-tracking
Patch Commit patch
Vulnerable code in index.mjs technical-description
https://github.com/tianma-if/edgeever product
VulnCheck Advisory: EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate third-party-advisory