CVE-2026-10032

The CVSS 6.1 score for CVE-2026-10032 is misleading. This vulnerability allows arbitrary javascript: URI execution through the openUrl function in @a2ui/web_core's Button component functionCall action. The description's own 'Critical severity' label is the correct assessment — the CVSS formula treats 'user clicks the button' as a constraint that reduces severity, but when the Basic Catalog is enabled by default (as it is), that click is the expected user experience, not an exceptional condition. This is not a misconfiguration being weaponized; it's the product's intended behavior being exploited. The core issue: openUrl passes arbitrary strings directly to window.open() with no scheme validation. The javascript: URI scheme has been a documented XSS vector for over twenty years — treating it as a surprising edge case misunderstands the attack surface. Any function wrapping window.open() without scheme allowlisting (restricting to http/https) is operating in what the security community calls a 'pit of failure.' Immediate actions: audit your codebase for any Button components using functionCall actions, particularly those rendering from the Basic Catalog. Verify whether your integration treats agents as sandboxed or trusted — if agents can inject configuration without isolation, the blast radius extends to every user encountering those buttons. The fix is scheme allowlisting on openUrl, but also audit every call site that touches window.open() for the same pattern. The stored versus reflected characterization in the description matters: if the javascript: payload persists in agent configuration across sessions, the impact is persistent rather than interaction-gated — treat this as a higher-severity finding if persistence is confirmed.

Reviewed through automated stages and approved by a human before publication.