CVE-2026-106101: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

A DOM Clobbering vulnerability exists in Quasar’s openURL() utility when handling the iOS SafariViewController bridge.

The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as <a id="SafariViewController"> can cause the browser to expose that element as window.SafariViewController.

When openURL() is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:

TypeError: window.SafariViewController.isAvailable is not a function

This can cause client-side denial of service and break navigation-related workflows in Quasar applications.