EUVD-2026-85565
GHSA-g53h-c489-2f5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious page with select+fullscreen
-
ExploitLure Arc user to open page
-
ExecutionTrigger requestFullscreen without notification
-
ImpactRender fake address bar for phishing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Requires a victim running Arc to open an attacker-controlled web page and interact with it: a <select> element on that page invokes requestFullscreen, and because Arc fails to display the fullscreen notification, the attacker can paint a spoofed address bar over the real one. Limiting factors: exploitation is gated on user interaction (UI:R) and social engineering to reach the malicious page; it is confined to the Arc browser (The Browser Company of New York), a niche consumer product; and it yields no direct data access or code execution - impact is deception/phishing only, with success further depending on the victim trusting the spoofed UI and entering sensitive data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N, 7.4) describes a remotely-reachable, low-complexity, unauthenticated flaw whose only hard gate is user interaction (UI:R). The scope change (S:C) reflects that malicious web content escapes its origin sandbox to manipulate trusted browser chrome, and the impact is integrity-only (I:H) with no confidentiality or availability effect - consistent with a spoofing weakness (CWE-451) rather than data theft or code execution. Signal strength beyond CVSS is weak: no EPSS score is provided, the flaw is NOT in CISA KEV (no confirmed active exploitation), and no SSVC decision data is supplied. A HackerOne report (3711701) is referenced, but that is a vulnerability disclosure report, not a confirmed public weaponized exploit, so it should not be read as active exploitation. Realistically this is a moderate-severity spoofing/phishing enabler, not a top-tier priority: it requires victim interaction, delivers no direct system compromise, and affects a niche browser. The vendor's I:H (which drives the 7.4) is arguably high for pure address-bar spoofing - an I:L rating (~5.8) is more defensible. Note the input Tags label this 'Information Disclosure,' which conflicts with the CVSS vector (C:N) and the CWE - the actual impact is integrity/UI-misrepresentation, so treat the disclosure framing as downstream phishing risk, not a confirmed confidentiality impact. |
| Exploit ScenarioDerived | An attacker hosts a malicious page and lures an Arc user to visit it (e.g., via a link). The page uses a <select> element to invoke requestFullscreen without Arc rendering the fullscreen notification, then paints a counterfeit address bar showing a trusted domain (e.g., a bank), enabling convincing credential-harvesting phishing. A vulnerability report exists on HackerOne (3711701), but no confirmed weaponized public exploit is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Update Arc to the newest release published by The Browser Company and confirm the affected version range against the vendor bulletin at https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element - the supplied data does not specify an exact fixed version, so the bulletin (not this analysis) is the source for the patch level, and the HackerOne report https://hackerone.com/reports/3711701 provides the reproduction detail. Until users are on a patched build, the practical mitigations are behavioral and permission-based: restrict the Fullscreen permission for untrusted sites (Arc site settings honor the Chromium-style Fullscreen permission model), which prevents the requestFullscreen call that underpins the overlay - the trade-off is broken legitimate fullscreen video, presentations, and web games, so it should be scoped to risky origins rather than applied globally; treat address-bar trust as unreliable on pages reached from links, messages, or ads and verify the real origin via the page-information/keyboard inspection affordances that live outside the spoofable region; and never enter credentials or payment data on a page whose provenance was not independently established. Because this is a niche consumer browser with no server-side component, network blocks, WAF rules, or enterprise policy enforcement do not meaningfully reduce exposure - the sole durable fix is upgrading Arc once the vendor bulletin identifies the patched version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a UI-misrepresentation class issue (CWE-451: User Interface (UI) Misrepresentation of Critical Information) rooted in the HTML Fullscreen API. Browsers gate requestFullscreen() behind a transient user activation and, critically, are expected to display a persistent fullscreen notification/warning so the user understands that page content is operating outside normal browser chrome. In Arc, a <select> element in attacker-controlled markup can trigger requestFullscreen without Arc rendering that notification, removing the trusted cue and allowing the attacker's page to overlay a fabricated address bar. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N mirrors this: network-reachable, low complexity, no privileges required, but user interaction is mandatory, and Scope is Changed because the deception crosses from web content into browser UI. The CPE cpe:2.3:a:the_browser_company_of_new_york:arc:*:*:*:*:*:*:*:* covers the Arc browser across all versions and platforms, i.e. no version is excluded. Impact is confined to visual spoofing/phishing - confidentiality and availability are unaffected, and the independent assessment further constrains integrity to low (I:L), consistent with deception that still depends on the victim trusting the fake UI and entering data.
Know when Arc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Remote, low-complexity, unauthenticated but needs user interaction (UI:R); sandbox-to-chrome spoofing is S:C; impact is UI-misrepresentation so I:L (not full I:H), C:N/A:N.
Primary rating from Vendor (BCNY).
CVSS VectorVendor: BCNY
Lifecycle Timeline
2DescriptionCVE.org
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
Executive ViewAI
Arc Browser contains a high-severity address bar spoofing flaw (CVE-2026-94181) that enables attackers to display a convincing fake address bar to users, facilitating phishing and credential theft. Employees who use Arc for corporate browsing are at risk of being deceived into entering sensitive information on malicious sites. While no public exploit has been identified at time of analysis, the lack of a vendor patch means the risk persists and requires immediate mitigating actions.
No vendor-released patch identified at time of analysis. Interim mitigations include: disabling or restricting Arc Browser for sensitive workflows; enforcing phishing-resistant MFA; training users to verify fullscreen notifications and address bars; monitoring authentication logs for anomalies; and using alternative browsers until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permi
Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary f
Missing application-layer authentication in Arc Enterprise's cluster replication receiver (prior to version 2026.06.1) a
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on th
The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perfor
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the
Exploit-DB