EdgeEver Desktop versions 1.6.26 through 1.112.0 contain a navigation allowlist bypass that allows attackers to load arbitrary origins in the main window by exploiting string‑prefix URL matching. By weaving a link that uses the userinfo syntax after the dev‑server prefix, an attacker can obtain the edgeeverDesktop bridge, which exposes the session token, sidecar remote procedure call interface, and ACP channels. This capability enables attackers to execute remote commands, hijack the user session, or exfiltrate sensitive data stored within the application.

The vulnerability affects the EdgeEver Desktop application released by tianma‑if. All builds from version 1.6.26 up to and including 1.112.0 are impacted. Users running any of these releases should check their installation date and version number.

The CVSS score of 8.4 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. No public exploits are reported, but the attack path relies on the ability to embed a crafted link within a note‑template preview or similar content. Attackers that can influence or inject content into the application may be able to exploit this bypass; the likely vector is local to the host running EdgeEver Desktop, particularly when users open documents they do not trust.