Vulnerability · Published Sep 23, 2026 · Assigned by BCNY

CVE-2026-94183Address bar spoofing risk in affected Android versions of Arc Search

High 7.4

In plain English

A high-severity security flaw in Arc Search from The Browser Company of New York. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

Affected products (as reported)

Vendor	Product	Versions
The Browser Company of New York	Arc Search	0 – before 1.12.10

Weakness: CWE-451 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

In plain English

Official description

Affected products (as reported)

References