CVE-2026-109556 Details

A remote code execution vulnerability has been identified in EdgeEver Desktop versions 1.92.0 through 1.112.0. The issue resides in the 'desktop:acp-probe' IPC handler, which lacks a sender verification and executes a user-supplied executable. This vulnerability can be exploited by attackers who have the ability to execute scripts in a renderer, such as through stored cross-site scripting in template previews or drag previews. By calling 'probeAcpAdapter' with a crafted input, attackers can launch local executables with the privileges of the user.

The vulnerability has been addressed in version 1.113.0 of EdgeEver Desktop. Users are advised to update to this version. The update includes a fix that adds a sender check to the 'desktop:acp-probe' channel, ensuring that only the main window can invoke it. Additionally, the fix implements a proper path validation and selection process for the Antigravity adapter, preventing unauthorized execution of local programs.