Does QUIC use a 96-bit MAC tag? If so, what are the implications? Does QUIC use a 96-bit MAC tag?  If so, what are the implications regarding forgery of messages?
One can argue about whether security for adversaries running in time $2^{96}$ is feasible or not, and the current standard is to require 128-bit security (or at least 112). However, an attack requiring sending in the range of $2^{90}$ messages to attempt to forge is way beyond feasible. The success probability of an attacker shouldn't exceed something reasonable, but what is reasonable is also subjective. NIST recommends that for block cipher modes of operation, the probability of a breach shouldn't exceed $2^{-32}$. For that reason, with a random IV, you can only use CTR or GCM to encrypt $2^{32}$ different messages (since the IV is of length 96 and you have a birthday problem). For MAC tags, taking 96 bits is more than enough...