GHSA-89VP-X45C-52CQ
Vulnerability from github – Published: 2026-10-07 20:23 – Updated: 2026-10-07 20:23Summary
A DOM Clobbering vulnerability exists in Quasar's openURL() utility when handling the iOS SafariViewController bridge.
The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as <a id="SafariViewController"> can cause the browser to expose that element as window.SafariViewController.
When openURL() is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:
TypeError: window.SafariViewController.isAvailable is not a function
This can cause client-side denial of service and break navigation-related workflows in Quasar applications.
Details
Quasar provides the openURL() utility to open external URLs. On iOS platforms, this utility supports integration with the native SafariViewController bridge.
The vulnerable code is located in:
ui/src/utils/open-url/open-url.js
````
The affected logic is:
```javascript
if (Platform.is.ios && window.SafariViewController !== void 0) {
window.SafariViewController.isAvailable(available => {
if (available) {
window.SafariViewController.show({ url }, noop, reject)
}
})
}
````
The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.
Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:
```html
<a id="SafariViewController"></a>
can cause:
window.SafariViewController
to resolve to an HTMLAnchorElement instead of the expected native bridge object.
When Quasar later executes:
window.SafariViewController.isAvailable(...)
the DOM element is incorrectly treated as the bridge object, causing:
TypeError: window.SafariViewController.isAvailable is not a function
The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.
The vulnerability was verified through the Quasar QEditor rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the SafariViewController named element, subsequent calls to openURL() fail.
Additional component-level affected paths were identified in QSelect and QChatMessage when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.
PoC
Steps to reproduce
- Render attacker-controlled HTML content through a Quasar HTML rendering component such as
QEditor. - Insert the following payload:
<a id="SafariViewController" href="#bridge">
SafariViewController
</a>
````
3. Verify that the browser exposes the element as a global property:
```javascript
window.SafariViewController
The value resolves to the injected DOM element instead of the expected native bridge object.
- Trigger a normal workflow that invokes:
openURL('https://example.com')
- Observe the browser console output:
TypeError: window.SafariViewController.isAvailable is not a function
The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.
The same underlying issue can also affect other HTML rendering paths such as QSelect and QChatMessage when attacker-controlled HTML is rendered and the application later calls openURL().
Impact
This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS SafariViewController integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's openURL() functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.
Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.
The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered SafariViewController object, preventing the expected URL opening behavior.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.32.1"
},
"package": {
"ecosystem": "npm",
"name": "quasar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.32.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-106101"
],
"database_specific": {
"cwe_ids": [
"CWE-843"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T20:23:47Z",
"nvd_published_at": "2026-10-06T17:17:24Z",
"severity": "LOW"
},
"details": "### Summary\n\nA DOM Clobbering vulnerability exists in Quasar\u0027s `openURL()` utility when handling the iOS `SafariViewController` bridge.\n\nThe vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `\u003ca id=\"SafariViewController\"\u003e` can cause the browser to expose that element as `window.SafariViewController`.\n\nWhen `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThis can cause client-side denial of service and break navigation-related workflows in Quasar applications.\n\n### Details\n\nQuasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.\n\nThe vulnerable code is located in:\n\n```\nui/src/utils/open-url/open-url.js\n````\n\nThe affected logic is:\n\n```javascript\nif (Platform.is.ios \u0026\u0026 window.SafariViewController !== void 0) {\n window.SafariViewController.isAvailable(available =\u003e {\n if (available) {\n window.SafariViewController.show({ url }, noop, reject)\n }\n })\n}\n````\n\nThe issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.\n\nModern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:\n\n```html\n\u003ca id=\"SafariViewController\"\u003e\u003c/a\u003e\n```\n\ncan cause:\n\n```javascript\nwindow.SafariViewController\n```\n\nto resolve to an `HTMLAnchorElement` instead of the expected native bridge object.\n\nWhen Quasar later executes:\n\n```javascript\nwindow.SafariViewController.isAvailable(...)\n```\n\nthe DOM element is incorrectly treated as the bridge object, causing:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.\n\nThe vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.\n\nAdditional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.\n\n### PoC\n\n#### Steps to reproduce\n\n1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.\n2. Insert the following payload:\n```html\n\u003ca id=\"SafariViewController\" href=\"#bridge\"\u003e\n SafariViewController\n\u003c/a\u003e\n````\n\n3. Verify that the browser exposes the element as a global property: \n\n```javascript\nwindow.SafariViewController\n```\n\nThe value resolves to the injected DOM element instead of the expected native bridge object.\n\n4. Trigger a normal workflow that invokes: \n\n```javascript\nopenURL(\u0027https://example.com\u0027)\n```\n\n5. Observe the browser console output: \n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.\n\nThe same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.\n\n### Impact\n\nThis vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar\u0027s `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.\n\nPotentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.\n\nThe confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.",
"id": "GHSA-89vp-x45c-52cq",
"modified": "2026-10-07T20:23:47Z",
"published": "2026-10-07T20:23:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106101"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
},
{
"type": "PACKAGE",
"url": "https://github.com/quasarframework/quasar"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.