EdgeEver Desktop 1.92.0 through 1.112.0 includes a flaw in the desktop:acp-probe IPC handler that does not validate the sender before launching an executable supplied by the caller. This missing sender check (CWE-749) allows an attacker with script execution in the renderer process—such as via a template-preview or drag-preview cross-site scripting vector—to call probeAcpAdapter and launch local binaries using the credentials of the user running the client. The result is the ability to run arbitrary code locally without further user interaction, giving the attacker local program execution.

All installations of EdgeEver Desktop from version 1.92.0 through 1.112.0, including any build numbers within that range, are vulnerable. The vendor, Tianma-IF, does not specify exact patch versions in the advisory, so the entire range must be considered at risk.

The vulnerability carries a CVSS score of 7.3, indicating high severity. EPSS information is unavailable, and the issue has not appeared in CISA’s KEV catalog, suggesting no documented real‑world exploits to date. The likely attack vector is local; an attacker must first obtain script-execution privileges in a renderer context, which can be achieved through known XSS avenues. Once that condition is met, the flaw can be exploited to launch any local executable with the victim’s user rights.