← Vulnerability feed

Vulnerability record · CVE-2026-94183 · published 23 September 2026

CVE-2026-94183: Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fu…

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

7.4 CVSS 3.1 High EPSS 0.20% · top 90.7% CWE-451 · CWE-451 Awaiting Analysis
7.4CVSS 3.1 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
24 Sep 2026Last modified by NVD

Description

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References

LinkTags
https://arc.net/security/bulletins#cve-2026-94183-address-bar-spoof-risk-missing-fullscreen-notification-on-return-from-
https://hackerone.com/reports/3572193

Track CVE-2026-94183 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-43461Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. Th…KEVEPSS 54%analysed7.5CVE-2024-38112Microsoft Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML platform affecting a broad range of Windows 10, Windows 11 and Windows Server releas…KEVEPSS 84%analysed

Source: NIST National Vulnerability Database (record CVE-2026-94183), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.