Description
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tianma-if EdgeEver
Default version status: unaffected
1.6.26 to ≤ 1.112.0affected
pkg:github/tianma-if/edgeeverReferences
- https://github.com/tianma-if/edgeever/issues/536 ↗
- https://github.com/tianma-if/edgeever/issues/546 ↗
- https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca ↗
- https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/desktop/src/main/index.mjs#L1560-L1564 ↗
- https://github.com/tianma-if/edgeever ↗
- https://www.vulncheck.com/advisories/edgeever-desktop-1.6.26-through-1.112.0-navigation-allowlist-bypass-via-will-navigate ↗