CVE-2026-96854 is a type confusion vulnerability in the Windows Device Association Service affecting multiple builds of Microsoft Windows 10, including version 1607 and later updates. This flaw allows an authorized local attacker to disclose information by accessing resources using incompatible types. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.
CVE-2026-83763 is a type confusion vulnerability in the Windows Input System of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has been assigned a high severity score of 7.8 and affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes for all affected versions.
CVE-2026-83664 is a type confusion vulnerability in the Windows Portable Device File System Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by accessing resources using incompatible types. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.
CVE-2026-70051 is a type confusion vulnerability in Windows SmartScreen on Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 builds prior to their respective fixed versions. An official fix is available from Microsoft.
CVE-2026-69880 is a type confusion vulnerability in the Desktop Window Manager component of Microsoft Windows 10 Version 1809 and related builds. It allows a locally authorized attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 versions prior to specific fixed builds. An official patch is available from Microsoft.
CVE-2026-96921 is a type confusion vulnerability in the Windows Message Queuing Queue Manager component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to disclose information by accessing a resource using an incompatible type. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 versions.
CVE-2026-70167 is a high-severity type confusion vulnerability in the DNS Server component of Microsoft Windows Server 2022. It allows an authorized attacker with network access and low privileges to execute arbitrary code remotely. The flaw arises from accessing resources using incompatible types, leading to potential code execution. Microsoft has released official patches that fix this vulnerability in specific Windows Server 2022 builds.
CVE-2026-85377 is a type confusion vulnerability in the Windows CD-ROM Driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
CVE-2026-83642 is a type confusion vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network by accessing resources using incompatible types. The vulnerability has a high severity score and affects multiple Windows 10 versions prior to specific fixed releases.
CVE-2026-70225 is a type confusion vulnerability in the Windows Ancillary Function Driver for WinSock on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has a high severity rating and affects multiple Windows 10 builds prior to specific fixed versions.
CVE-2026-70205 is a type confusion vulnerability in the Windows Ancillary Function Driver for WinSock on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-70245 is a type confusion vulnerability in the Windows Ancillary Function Driver for WinSock on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges by accessing resources using incompatible types. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this issue.
CVE-2026-70017 is a type confusion vulnerability in the Windows Secure Kernel Mode of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to disclose information by accessing resources using incompatible types. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-69926 is a type confusion vulnerability in the Desktop Window Manager component of Microsoft Windows 10 Version 1809 and related builds. It allows a locally authorized attacker to elevate privileges by accessing resources using incompatible types. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 versions prior to their respective fixed releases. Official fixes have been released by Microsoft.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a type confusion vulnerability in the INFO, JSON, and YAML encoders. This flaw occurs when an internal method receives a pointer of an unexpected type during image writing in compressed formats. Exploitation can cause the process to crash with SIGABRT or SIGSEGV, resulting in denial of service.
CVE-2026-106433 is a high-severity type confusion vulnerability in MongoDB's libmongocrypt library. It arises from improper state management when cleaning up key documents containing duplicate masterKey fields, leading to incompatible type usage. An authenticated actor who can modify key vault documents or a server returning such malformed key documents may cause invalid memory access or frees in the client process. This can result in application termination or memory corruption.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
CVE-2026-106587 is a low-severity vulnerability in OpenSSH before version 10.6 where the configuration option value "none" is sometimes incorrectly interpreted as a filename instead of disabling a feature. This type confusion flaw can lead to unintended behavior in the sshd daemon.
CVE-2026-106446 is a critical code injection vulnerability in handlebars.js versions 4.0.0 up to but not including 4.7.10. The vulnerability arises because Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects without fully validating all node values, allowing untrusted input objects to inject arbitrary JavaScript code. This can lead to remote code execution on the server or malicious code execution in client environments where precompiled templates are used. Applications passing untrusted objects instead of strings to these functions are affected. The vulnerability has a CVSS score of 9.8, indicating critical severity.
### Summary
A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge.
The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `<a id="SafariViewController">` can cause the browser to expose that element as `window.SafariViewController`.
When `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
This can cause client-side denial of service and break navigation-related workflows in Quasar applications.
### Details
Quasar provides the `openURL()` utility to open external URLs. On iOS platforms, this utility supports integration with the native `SafariViewController` bridge.
The vulnerable code is located in:
```
ui/src/utils/open-url/open-url.js
````
The affected logic is:
```javascript
if (Platform.is.ios && window.SafariViewController !== void 0) {
window.SafariViewController.isAvailable(available => {
if (available) {
window.SafariViewController.show({ url }, noop, reject)
}
})
}
````
The issue is that Quasar only verifies that `window.SafariViewController` is not `undefined`. It does not verify whether the value is the expected native bridge object or whether required methods such as `isAvailable()` and `show()` are valid functions.
Modern browsers expose elements with specific `id` or `name` attributes as properties of the global `window` object. Therefore, attacker-controlled HTML such as:
```html
<a id="SafariViewController"></a>
```
can cause:
```javascript
window.SafariViewController
```
to resolve to an `HTMLAnchorElement` instead of the expected native bridge object.
When Quasar later executes:
```javascript
window.SafariViewController.isAvailable(...)
```
the DOM element is incorrectly treated as the bridge object, causing:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
The root cause is insufficient validation of browser-controlled global properties before using them as trusted native bridge objects.
The vulnerability was verified through the Quasar `QEditor` rendering path. When attacker-controlled HTML content is rendered into the DOM and creates the `SafariViewController` named element, subsequent calls to `openURL()` fail.
Additional component-level affected paths were identified in `QSelect` and `QChatMessage` when applications enable HTML rendering features and provide attacker-controlled content. These paths require specific application configurations and were not used as the primary end-to-end reproduction.
### PoC
#### Steps to reproduce
1. Render attacker-controlled HTML content through a Quasar HTML rendering component such as `QEditor`.
2. Insert the following payload:
```html
<a id="SafariViewController" href="#bridge">
SafariViewController
</a>
````
3. Verify that the browser exposes the element as a global property:
```javascript
window.SafariViewController
```
The value resolves to the injected DOM element instead of the expected native bridge object.
4. Trigger a normal workflow that invokes:
```javascript
openURL('https://example.com')
```
5. Observe the browser console output:
```
TypeError: window.SafariViewController.isAvailable is not a function
```
The URL opening workflow fails because Quasar attempts to invoke native bridge methods on the DOM element.
The same underlying issue can also affect other HTML rendering paths such as `QSelect` and `QChatMessage` when attacker-controlled HTML is rendered and the application later calls `openURL()`.
### Impact
This vulnerability is a client-side DOM Clobbering and type confusion issue affecting Quasar applications that use the iOS `SafariViewController` integration. An attacker who can control HTML content rendered into the application DOM may cause Quasar's `openURL()` functionality to fail by replacing the expected native bridge object with a DOM element through browser named property resolution.
Potentially affected workflows include external URL navigation, OAuth/login redirects, help or documentation links, payment flows, third-party service redirects, and other application actions that rely on URL opening functionality.
The confirmed impact is client-side denial of service and navigation or workflow disruption. When the vulnerable condition is triggered, Quasar throws an exception while attempting to invoke methods on the clobbered `SafariViewController` object, preventing the expected URL opening behavior.