EIP-2026-118814

This is a vulnerability writeup describing a URI handling flaw in multiple vendors' products, where a '-' character preceding the hostname allows passing arbitrary options to protocol handlers like telnet, rlogin, ssh, and mailto. Successful exploitation could lead to arbitrary file creation/modification or denial of service in the browser context.