Skip to content
OpenAdvisories

Product · Google

@a2ui/web_core

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-10032

    Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

    The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user cl…

    Google @a2ui/web_core @a2ui/web_core npm