@A2Ui/Web Core
Approved changes feed: RSS · Atom
cpe:2.3:a:google:@a2ui/web_core:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Google (f181d1eb-7269-5bae-b76e-e66ceb214562) |
|---|---|
| Product | @A2Ui/Web Core (926fdd7a-b808-519f-ba21-863e4aef7aa3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-10032 |
vulnerable | 2026-09-16 04:32:43.134614 |
Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
Published: 2026-08-04T15:36:45.199Z
Updated: 2026-08-04T17:43:20.898Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.