Remote Code Execution Vulnerability in EdgeEver Desktop by Tianma

CVE-2026-109556

What is CVE-2026-109556?

EdgeEver Desktop versions 1.92.0 through 1.112.0 have a remote code execution vulnerability due to a flaw in the desktop:acp-probe IPC handler. This vulnerability allows attackers to bypass the sender check, enabling execution of arbitrary programs on the desktop with the privileges of the affected user. Exploitation requires a script execution environment within a renderer, which can be achieved via cross-site scripting techniques. This presents a significant risk, as it allows for malicious local executable launches.

References