This vulnerability allows an attacker to trigger a client‑side denial of service by hijacking the SafariViewController integration in Quasar’s openURL() utility. When an attacker’s HTML defines a named SafariViewController element, the browser resolves the element as the native bridge object. Subsequent calls to openURL() invoke isAvailable() on that element, throw a TypeError, and break external navigation, login redirects, payment redirects, and other URL‑opening workflows, effectively halting user interaction.

Quasar Framework versions prior to 2.32.2 are affected. Components that render attacker‑controlled HTML, such as QEditor, QSelect and QChatMessage, can trigger the flaw. Only users deploying the openURL() feature in an iOS environment where window.SafariViewController is present need to be concerned.

The CVSS score is 3.1, indicating medium impact and low exploitation complexity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is attacker‑controlled HTML rendered through vulnerable components; as the flaw requires client‑side JavaScript execution, an attacker who can inject malicious markup into the page can exploit it. Given the ease of triggering, organizations should treat it as a low‑to‑medium risk but still patch promptly.