CVE-2026-106101: Quasar Framework DOM Clobbering Vulnerability in openURL() Utility
Summary
CVE-2026-106101: A DOM Clobbering vulnerability exists in Quasar's openURL() utility when handling the iOS SafariViewController bridge. Affects quasar versions < 2.32.2. Fixed in 2.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quasar is a popular open-source framework designed for building responsive web applications using Vue.js. It provides a wide range of features, including a utility called openURL() that allows developers to open external URLs seamlessly. However, a vulnerability has been identified in the integration of this utility with the iOS SafariViewController, which can lead to client-side denial of service.
Vulnerability Detail
The vulnerability arises from a DOM Clobbering issue in Quasar's openURL() utility. It occurs when the framework checks for the existence of window.SafariViewController without validating whether it is the expected native bridge object. An attacker can inject HTML content that creates a named element, such as <a id="SafariViewController">, which causes the browser to expose this element as window.SafariViewController. When openURL() is called, Quasar mistakenly treats the DOM element as the native bridge object, leading to a TypeError when attempting to invoke methods that do not exist. This results in client-side denial of service and disrupts navigation-related workflows in Quasar applications.
How To Fix
Latest published version: 2.35.2 as of 23 Oct 2026
npm install quasar@2.35.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.32.2
This is the first release that contains the fix.
npm install quasar@2.32.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid rendering attacker-controlled HTML content in Quasar components that utilize the openURL() utility. Ensure that any HTML content rendered does not include elements with the id 'SafariViewController' or similar named attributes that could lead to DOM Clobbering.
Conclusion
The Quasar Framework vulnerability identified as CVE-2026-106101 poses a risk of client-side denial of service due to DOM Clobbering in the openURL() utility. It is crucial for developers to update to the patched version of Quasar to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for quasar →
FAQ
The vulnerability is a DOM Clobbering issue that allows an attacker to manipulate the global window object, leading to client-side denial of service.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
The vulnerability can disrupt navigation workflows, affecting external URL navigation, OAuth redirects, and other application actions that rely on the openURL() functionality.
Yes, the CVSS score for this vulnerability is 3.1, indicating a low severity level.
If you cannot update the package right away, ensure that you do not render any attacker-controlled HTML content that could lead to DOM Clobbering.
References
Related vulnerabilities
Recent vulnerabilities recorded for quasar.
