EUVD-2026-52744

@a2ui/webcore: openUrl permits javascript: URI execution via agent-supplied button actions...