Vulnerability-Lookup

CVE-2026-106101 (GCVE-0-2026-106101)

Vulnerability from cvelistv5 – Published: 2026-10-06 17:04 – Updated: 2026-10-06 17:26

Title

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Summary

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:24 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7920 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/quasarframework/quasar/securit…	x_refsource_CONFIRM
https://github.com/quasarframework/quasar/commit/…	x_refsource_MISC
https://github.com/quasarframework/quasar/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
quasarframework	quasar	Affected: < 2.32.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106101",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:24:41.442349Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:26:21.581Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.32.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T17:04:39.673Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
        },
        {
          "name": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
        },
        {
          "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
        }
      ],
      "source": {
        "advisory": "GHSA-89vp-x45c-52cq",
        "discovery": "UNKNOWN"
      },
      "title": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106101",
    "datePublished": "2026-10-06T17:04:39.673Z",
    "dateReserved": "2026-10-06T15:33:55.332Z",
    "dateUpdated": "2026-10-06T17:26:21.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106101",
      "date": "2026-10-28",
      "epss": "0.00256",
      "percentile": "0.17182"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "quasar",
                "vendor": "quasarframework",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.32.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
          }
        ],
        "id": "CVE-2026-106101",
        "lastModified": "2026-10-06T20:03:40.690",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-106101",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:24:41.442349Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T17:17:24.110",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-843"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-106101",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T17:24:41.442349Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T17:25:16.048Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "quasar",
              "vendor": "quasarframework",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.32.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-843",
                  "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T17:04:39.673Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
            },
            {
              "name": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
            },
            {
              "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
            }
          ],
          "source": {
            "advisory": "GHSA-89vp-x45c-52cq",
            "discovery": "UNKNOWN"
          },
          "title": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-106101",
        "datePublished": "2026-10-06T17:04:39.673Z",
        "dateReserved": "2026-10-06T15:33:55.332Z",
        "dateUpdated": "2026-10-06T17:26:21.581Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-106101

Vulnerability from fkie_nvd - Published: 2026-10-06 17:17 - Updated: 2026-10-06 20:03

Severity

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec
	security-advisories@github.com	https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2
	security-advisories@github.com	https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.32.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
    }
  ],
  "id": "CVE-2026-106101",
  "lastModified": "2026-10-06T20:03:40.690",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106101",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-06T17:24:41.442349Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T17:17:24.110",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-89VP-X45C-52CQ

Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23

Summary

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Details

Summary

A DOM Clobbering vulnerability exists in Quasar's openURL() utility when handling the iOS SafariViewController bridge.

The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as <a id="SafariViewController"> can cause the browser to expose that element as window.SafariViewController.

When openURL() is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:

TypeError: window.SafariViewController.isAvailable is not a function

This can cause client-side denial of service and break navigation-related workflows in Quasar applications.

Details

Quasar provides the openURL() utility to open external URLs. On iOS platforms, this utility supports integration with the native SafariViewController bridge.

The vulnerable code is located in:

ui/src/utils/open-url/open-url.js
````

The affected logic is:

```javascript
if (Platform.is.ios && window.SafariViewController !== void 0) {
  window.SafariViewController.isAvailable(available => {
    if (available) {
      window.SafariViewController.show({ url }, noop, reject)
    }
  })
}
````

The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.

Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:

```html
<a id="SafariViewController"></a>

can cause:

window.SafariViewController

to resolve to an HTMLAnchorElement instead of the expected native bridge object.

When Quasar later executes:

window.SafariViewController.isAvailable(...)

the DOM element is incorrectly treated as the bridge object, causing:

TypeError: window.SafariViewController.isAvailable is not a function

The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.

The vulnerability was verified through the Quasar QEditor rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the SafariViewController named element, subsequent calls to openURL() fail.

Additional component-level affected paths were identified in QSelect and QChatMessage when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.

PoC

Steps to reproduce

Render attacker-controlled HTML content through a Quasar HTML rendering component such as QEditor.
Insert the following payload:

<a id="SafariViewController" href="#bridge">
  SafariViewController
</a>
````

3. Verify that the browser exposes the element as a global property:   

```javascript
window.SafariViewController

The value resolves to the injected DOM element instead of the expected native bridge object.

Trigger a normal workflow that invokes:

openURL('https://example.com')

Observe the browser console output:

TypeError: window.SafariViewController.isAvailable is not a function

The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.

The same underlying issue can also affect other HTML rendering paths such as QSelect and QChatMessage when attacker-controlled HTML is rendered and the application later calls openURL().

Impact

This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS SafariViewController integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's openURL() functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.

Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.

The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered SafariViewController object, preventing the expected URL opening behavior.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.32.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "quasar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.32.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:23:47Z",
    "nvd_published_at": "2026-10-06T17:17:24Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA DOM Clobbering vulnerability exists in Quasar\u0027s `openURL()` utility when handling the iOS `SafariViewController` bridge.\n\nThe vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `\u003ca id=\"SafariViewController\"\u003e` can cause the browser to expose that element as `window.SafariViewController`.\n\nWhen `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThis can cause client-side denial of service and break navigation-related workflows in Quasar applications.\n\n### Details\n\nQuasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.\n\nThe vulnerable code is located in:\n\n```\nui/src/utils/open-url/open-url.js\n````\n\nThe affected logic is:\n\n```javascript\nif (Platform.is.ios \u0026\u0026 window.SafariViewController !== void 0) {\n  window.SafariViewController.isAvailable(available =\u003e {\n    if (available) {\n      window.SafariViewController.show({ url }, noop, reject)\n    }\n  })\n}\n````\n\nThe issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.\n\nModern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:\n\n```html\n\u003ca id=\"SafariViewController\"\u003e\u003c/a\u003e\n```\n\ncan cause:\n\n```javascript\nwindow.SafariViewController\n```\n\nto resolve to an `HTMLAnchorElement` instead of the expected native bridge object.\n\nWhen Quasar later executes:\n\n```javascript\nwindow.SafariViewController.isAvailable(...)\n```\n\nthe DOM element is incorrectly treated as the bridge object, causing:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.\n\nThe vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.\n\nAdditional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.\n\n### PoC\n\n#### Steps to reproduce\n\n1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.\n2. Insert the following payload:\n```html\n\u003ca id=\"SafariViewController\" href=\"#bridge\"\u003e\n  SafariViewController\n\u003c/a\u003e\n````\n\n3. Verify that the browser exposes the element as a global property:   \n\n```javascript\nwindow.SafariViewController\n```\n\nThe value resolves to the injected DOM element instead of the expected native bridge object.\n\n4. Trigger a normal workflow that invokes:    \n\n```javascript\nopenURL(\u0027https://example.com\u0027)\n```\n\n5. Observe the browser console output:    \n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.\n\nThe same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.\n\n### Impact\n\nThis vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar\u0027s `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.\n\nPotentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.\n\nThe confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.",
  "id": "GHSA-89vp-x45c-52cq",
  "modified": "2026-10-07T20:23:47Z",
  "published": "2026-10-07T20:23:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quasarframework/quasar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106101 (GCVE-0-2026-106101)

FKIE_CVE-2026-106101

GHSA-89VP-X45C-52CQ

Summary

Details

PoC

Steps to reproduce

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour