CVE-2026-94183

Awaiting Analysis Awaiting Analysis - Queue

Fullscreen UI Spoofing in Arc Search for Android

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: BCNY

Description

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-94183

EUVD

EUVD-2026-85570

Affected Vendors & Products

Vendor	Product	Version / Range
arc_search	arc_search	to 1.12.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

Arc Search for Android before version 1.12.10 has a vulnerability where it fails to show a fullscreen notification when a webpage enters fullscreen mode while the app is running in the background. This allows a remote attacker to create fake UI elements, such as a spoofed address bar, tricking users into believing they are on a legitimate site.

Detection Guidance

This vulnerability involves Arc Search for Android not showing fullscreen notifications when a page enters fullscreen mode in the background. Detection would require checking if the app version is below 1.12.10 and monitoring for suspicious fullscreen UI elements during app background usage.

Impact Analysis

This vulnerability can trick you into thinking you are on a trusted website when you are not. Attackers could steal login credentials, personal data, or install malware by presenting fake interfaces that appear legitimate.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks through fake UI elements. Under GDPR, organizations must implement measures to ensure user interface integrity to protect personal data. HIPAA requires safeguards against unauthorized access or misleading user interfaces that could compromise protected health information.

Mitigation Strategies

Update Arc Search for Android to version 1.12.10 or later to address the vulnerability. Avoid using the app in the background while browsing untrusted websites to reduce exposure to potential phishing attempts.

Hi! I’m here to help you understand CVE-2026-94183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70