Attack Chain

1. An attacker designs a malicious agent response containing a Button component with a functionCall action.
2. The action is configured to trigger the openUrl function with a url parameter set to a javascript: URI (e.g., javascript:alert(document.cookie)).
3. The A2UI runtime library, specifically generic-binder.ts, intercepts the component click event.
4. The library calls dispatchAction, which triggers resolveDynamicValue to identify the function call.
5. The OpenUrlApi schema parser validates the input using only a basic string check, allowing the malicious URI to pass.
6. The OpenUrlImplementation passes the unvalidated URL string directly into window.open().
7. The browser executes the injected JavaScript code in the context of the user session, leading to full XSS.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser. This can lead to session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive data, or redirection to malicious websites. As this vulnerability resides in a core UI component library used across multiple frameworks, any application integrating @a2ui/web_core versions prior to 0.10.2 is susceptible to attack.

Recommendation

Prioritized actions for security and engineering teams to mitigate CVE-2026-10032:

• Update the dependency @a2ui/web_core to version 0.10.2 or later in all projects, as this release implements strict URI scheme validation to block non-HTTP/HTTPS protocols.
• Audit applications utilizing @a2ui/web_core to identify where agent-supplied inputs are mapped to button actions or URI-handling functions.
• Implement Content Security Policy (CSP) headers that restrict script sources and prevent inline script execution to mitigate the impact of potential XSS vulnerabilities in the front-end layer.