Arc Search CVE-2026-94183

Exploitation requires the victim to be running Arc Search for Android at a version before 1.12.10 and to visit an attacker-crafted webpage that programmatically enters fullscreen mode WHILE the app is in the background; the missing fullscreen-notification-on-return-from-background is the specific trigger. Limiting factors: the attacker cannot force this silently - the CVSS UI:R reflects that the user must load the malicious page and then be deceived by the spoofed UI (e.g., fake address bar), and the app must be transitioned to background and back for the notification-suppression condition to occur. There is no confidentiality or availability impact and no code execution; the payoff depends entirely on the user acting on the spoofed origin (phishing).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N, base 7.4) describes a network-reachable, low-complexity, unauthenticated UI-spoofing flaw (CWE-451) requiring victim interaction - the user must open an attacker-controlled site while Arc Search is backgrounded. The I:H/S:C weighting is what drives the score into the HIGH band; this is an integrity/deception issue, not code execution, so C:N and A:N are correct and the real-world impact is limited to convincing phishing/UI-spoofing rather than device compromise. No EPSS score, no CISA KEV entry, and no SSVC decision data were provided, so automatability and exploitation-maturity signals are absent. A HackerOne report (#3572193) and a vendor security bulletin exist, but neither is confirmed to contain weaponized exploit code - no public exploit identified at time of analysis. Net assessment: a legitimate but moderate-priority issue - the HIGH CVSS overstates urgency because impact is confined to user deception, exploitation depends on a specific background-state race plus user interaction, and the affected product (Arc Search for Android) has a small deployment footprint. The 'Information Disclosure' tag is misleading (see data_quality_flags): CWE-451 is UI misrepresentation/spoofing with I:H, not confidentiality loss.

A remote attacker hosts a crafted webpage that triggers fullscreen mode while Arc Search for Android (before 1.12.10) is running in the background; because the app fails to render the fullscreen notification on return from background, the page can draw fake UI elements such as a spoofed address bar. The victim reopens the browser, sees attacker-controlled content masquerading as a trusted origin (e.g., a bank login), and enters credentials into the phishing overlay. A private HackerOne report exists but no public weaponized exploit was provided.