CVE-2026-10032
Received Received - Intake

JavaScript URI XSS in @a2ui/web_core

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Google Inc.

Description
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-10032
EUVD
EUVD-2026-52744

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
a2ui web_core From 0.9.0 (inc) to 0.10.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in the @a2ui/web_core package. The openUrl function allows passing a malicious javascript: URI through a button component's functionCall action. When clicked, this executes arbitrary JavaScript in the victim's browser with the application's origin privileges, enabling stored or reflected XSS attacks.

Detection Guidance

Check if your application uses @a2ui/web_core versions 0.9.0 through 0.10.1. Inspect button components for javascript: URIs in functionCall actions. Review browser console logs for XSS attempts when buttons are clicked.

Impact Analysis

An attacker could steal sensitive data like session cookies or personal information, perform actions on your behalf, or redirect you to malicious sites. Since it requires user interaction (clicking a button), it could be exploited via phishing or compromised UI elements.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with security rules. Both standards mandate protection against such attacks.

Mitigation Strategies

Upgrade @a2ui/web_core to version 0.10.2 or later. Block javascript: URIs in URL validation. Implement input sanitization for button actions. Monitor for unusual JavaScript execution in browser consoles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart