EdgeEver Desktop CVE-2026-109556

Exploitation requires a chained foothold, not direct remote access: the attacker must first achieve stored cross-site scripting in a renderer through the template-preview or drag-preview feature, and the victim must then preview that attacker-controlled content (UI:A). Once script runs in the renderer, the desktop:acp-probe IPC handler is invokable because it lacks a sender check, letting probeAcpAdapter spawn any executable named in the caller-supplied input.path with the user's privileges. Limiting factors: only EdgeEver Desktop versions 1.92.0 through 1.112.0 are affected; a pre-existing XSS vector is mandatory (there is no standalone network RCE); and active user interaction is needed to trigger the vulnerable preview path.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 base score of 7.3 (High) reflects an attack vector of AV:N with low complexity (AC:L) but is tempered by an attack requirement (AT:P), low privileges (PR:L), and required active user interaction (UI:A); impact is full compromise of the vulnerable system (VC:H/VI:H/VA:H) with no subsequent-system impact. Critically, this is a chained vulnerability: the RCE is only reachable after an attacker already achieves script execution in a renderer via stored XSS (CWE-749, exposed dangerous IPC method lacking a sender check). No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public exploit was flagged - so exploitation status is 'no public exploit identified at time of analysis.' However, the fixing commit (6b5027e) and GitHub issues are public, which lowers the barrier to developing a working exploit. Weighing these signals together: the severity is real for any EdgeEver Desktop user on 1.92.0-1.112.0, but the multi-stage requirement (XSS foothold + user interaction) plus the product's apparently small deployment footprint make widespread, automated exploitation unlikely. Prioritize patching for actual EdgeEver users; deprioritize relative to internet-facing or ubiquitous-software CVEs.

An attacker plants a malicious payload in a template-preview or drag-preview surface that triggers stored cross-site scripting inside EdgeEver Desktop's renderer. When the victim previews that content, the injected script invokes probeAcpAdapter over the unguarded desktop:acp-probe IPC handler with a crafted input.path, causing the Electron main process to spawn that executable with the user's privileges. No public proof-of-concept was identified, though the public patch commit discloses the vulnerable code path.