Description
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tianma-if | EdgeEver | 1.6.26 – ≤ 1.112.0 | — |
References
- GitHub Issue #536 issue-tracking
- GitHub Issue #546 issue-tracking
- Patch Commit patch
- Vulnerable code in index.mjs technical-description
- https://github.com/tianma-if/edgeever product
- VulnCheck Advisory: EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate third-party-advisory