{"id":"CVE-2026-106101","aliases":["EUVD-2026-93516","GHSA-89vp-x45c-52cq"],"status":"published","title":"Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00256,"percentile":0.17358,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-10-06T17:04:39Z","modified":"2026-11-04T02:47:13Z","fixes":[{"ecosystem":"npm","package":"quasar","fixed_in":["2.32.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"quasar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.32.1"},{"fixed":"2.32.2"}]}]},{"source":"osv","ecosystem":"npm","package":"quasar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.32.2"}]}]}],"products":[{"vendor":"quasarframework","product":"quasar"}],"references":[{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106101","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-89vp-x45c-52cq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106101.json","tags":["advisory"]},{"url":"https://github.com/quasarframework/quasar","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-106101","title":"Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.","status":"published","published":"2026-10-06T17:04:39.673Z","modified":"2026-10-06T17:26:21.581Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-93516","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.","status":"published","published":"2026-10-06T17:04:39Z","modified":"2026-10-06T17:26:21Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T17:27:37.140631Z"}],"ghsa":[{"id":"GHSA-89vp-x45c-52cq","title":"Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service","description":"### Summary\n\nA DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge.\n\nThe vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `\u003ca id=\"SafariViewController\"\u003e` can cause the browser to expose that element as `window.SafariViewController`.\n\nWhen `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThis can cause client-side denial of service and break navigation-related workflows in Quasar applications.\n\n### Details\n\nQuasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.\n\nThe vulnerable code is located in:\n\n```\nui/src/utils/open-url/open-url.js\n````\n\nThe affected logic is:\n\n```javascript\nif (Platform.is.ios \u0026\u0026 window.SafariViewController !== void 0) {\n  window.SafariViewController.isAvailable(available =\u003e {\n    if (available) {\n      window.SafariViewController.show({ url }, noop, reject)\n    }\n  })\n}\n````\n\nThe issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.\n\nModern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:\n\n```html\n\u003ca id=\"SafariViewController\"\u003e\u003c/a\u003e\n```\n\ncan cause:\n\n```javascript\nwindow.SafariViewController\n```\n\nto resolve to an `HTMLAnchorElement` instead of the expected native bridge object.\n\nWhen Quasar later executes:\n\n```javascript\nwindow.SafariViewController.isAvailable(...)\n```\n\nthe DOM element is incorrectly treated as the bridge object, causing:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.\n\nThe vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.\n\nAdditional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.\n\n### PoC\n\n#### Steps to reproduce\n\n1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.\n2. Insert the following payload:\n```html\n\u003ca id=\"SafariViewController\" href=\"#bridge\"\u003e\n  SafariViewController\n\u003c/a\u003e\n````\n\n3. Verify that the browser exposes the element as a global property:   \n\n```javascript\nwindow.SafariViewController\n```\n\nThe value resolves to the injected DOM element instead of the expected native bridge object.\n\n4. Trigger a normal workflow that invokes:    \n\n```javascript\nopenURL('https://example.com')\n```\n\n5. Observe the browser console output:    \n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.\n\nThe same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.\n\n### Impact\n\nThis vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.\n\nPotentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.\n\nThe confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.","status":"published","published":"2026-10-07T20:23:47Z","modified":"2026-10-07T20:23:48Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-106101","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.","status":"published","published":"2026-10-06T17:17:24.11Z","modified":"2026-10-06T20:03:40.69Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"CVE-2026-106101","title":"Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.","status":"published","published":"2026-10-06T17:04:39.673Z","modified":"2026-11-05T03:29:06.499203745Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-843"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"GHSA-89vp-x45c-52cq","title":"Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service","description":"### Summary\n\nA DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge.\n\nThe vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `\u003ca id=\"SafariViewController\"\u003e` can cause the browser to expose that element as `window.SafariViewController`.\n\nWhen `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThis can cause client-side denial of service and break navigation-related workflows in Quasar applications.\n\n### Details\n\nQuasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.\n\nThe vulnerable code is located in:\n\n```\nui/src/utils/open-url/open-url.js\n````\n\nThe affected logic is:\n\n```javascript\nif (Platform.is.ios \u0026\u0026 window.SafariViewController !== void 0) {\n  window.SafariViewController.isAvailable(available =\u003e {\n    if (available) {\n      window.SafariViewController.show({ url }, noop, reject)\n    }\n  })\n}\n````\n\nThe issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.\n\nModern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:\n\n```html\n\u003ca id=\"SafariViewController\"\u003e\u003c/a\u003e\n```\n\ncan cause:\n\n```javascript\nwindow.SafariViewController\n```\n\nto resolve to an `HTMLAnchorElement` instead of the expected native bridge object.\n\nWhen Quasar later executes:\n\n```javascript\nwindow.SafariViewController.isAvailable(...)\n```\n\nthe DOM element is incorrectly treated as the bridge object, causing:\n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.\n\nThe vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.\n\nAdditional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.\n\n### PoC\n\n#### Steps to reproduce\n\n1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.\n2. Insert the following payload:\n```html\n\u003ca id=\"SafariViewController\" href=\"#bridge\"\u003e\n  SafariViewController\n\u003c/a\u003e\n````\n\n3. Verify that the browser exposes the element as a global property:   \n\n```javascript\nwindow.SafariViewController\n```\n\nThe value resolves to the injected DOM element instead of the expected native bridge object.\n\n4. Trigger a normal workflow that invokes:    \n\n```javascript\nopenURL('https://example.com')\n```\n\n5. Observe the browser console output:    \n\n```\nTypeError: window.SafariViewController.isAvailable is not a function\n```\n\nThe URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.\n\nThe same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.\n\n### Impact\n\nThis vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.\n\nPotentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.\n\nThe confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.","status":"published","published":"2026-10-07T20:23:47Z","modified":"2026-10-07T20:30:06.740467291Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}