CVE-2026-18534

Deferred Deferred - Pending Action

Address Bar Spoofing in ArcSearch for iOS

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: BCNY

Description

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-10-19

AI Q&A

2026-08-18

EPSS Evaluated

2026-10-18

NVD

CVE-2026-18534

EUVD

EUVD-2026-60946

Affected Vendors & Products

Vendor	Product	Version / Range
arcsearch	arcsearch	to 1.48.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

Executive Summary

ArcSearch for iOS versions before 1.48.0 had a flaw where the address bar could remain hidden after a page-initiated scroll. This allowed attacker-controlled content to mimic browser interface elements, increasing the risk of spoofing attacks where users might be tricked into thinking they are interacting with the browser itself.

Detection Guidance

This vulnerability is specific to the ArcSearch iOS app and involves UI spoofing due to hidden address bars. Detection requires checking the installed version of ArcSearch on iOS devices. If the version is prior to 1.48.0, the device is vulnerable.

Impact Analysis

This vulnerability could trick you into believing you are seeing legitimate browser UI elements like the address bar or security indicators. Attackers could use this to deceive you into entering sensitive information or performing actions under false pretenses.

Compliance Impact

This vulnerability could allow attacker-controlled content to imitate browser interface elements, potentially leading to phishing attacks or unauthorized data access. This may impact compliance with GDPR by increasing risks of data breaches or user deception, and with HIPAA by exposing sensitive health information through spoofed interfaces.

Mitigation Strategies

Update ArcSearch for iOS to version 1.48.0 or later to address the vulnerability. Ensure all iOS devices running ArcSearch apply this update immediately to prevent potential spoofing attacks.

Hi! I’m here to help you understand CVE-2026-18534. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70