CVE-2026-94181: Arc Browser Address Bar Spoofing Flaw

CVE-2026-94181 Overview

CVE-2026-94181 is an address bar spoofing vulnerability in the Arc browser. Attackers can abuse a <select> element that triggers requestFullscreen without displaying the standard fullscreen notification. This gap allows a malicious page to render fake browser chrome, including a spoofed address bar, and mislead users about the site they are viewing. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and requires user interaction to exploit. Arc published a security bulletin documenting the issue and shipped a fix.

Critical Impact
A spoofed address bar enables convincing phishing pages that appear to originate from trusted domains, undermining the primary trust signal users rely on in the browser.

Affected Products

Arc browser (versions prior to the fix referenced in the vendor bulletin)
Web rendering path that handles <select> element fullscreen transitions
Users interacting with untrusted web content in vulnerable Arc builds

Discovery Timeline

2026-09-23 - CVE CVE-2026-94181 published to NVD
2026-09-23 - Last updated in NVD database
Vendor coordination and reporting tracked in HackerOne Report #3711701

Technical Details for CVE-2026-94181

Vulnerability Analysis

The vulnerability lets a web page invoke the Fullscreen API through a <select> element without triggering Arc's fullscreen notification banner. Browsers normally display a transient overlay warning users that a page has entered fullscreen mode. This overlay exists specifically to prevent web content from imitating trusted browser chrome. When the notification is suppressed, an attacker can paint a counterfeit address bar and window controls that look indistinguishable from the real browser interface.

Successful exploitation requires the victim to click a <select> element on the attacker-controlled page. Once the page enters fullscreen silently, the attacker can render any URL string in the fake address bar. Users then interact with what appears to be a legitimate site while all input is captured by attacker-controlled content.

Root Cause

The root cause is a missing security UI notification in the code path that handles requestFullscreen calls originating from <select> element interactions. The fullscreen transition proceeds without the mandatory user-facing indicator, breaking the invariant that browser-rendered chrome is always distinguishable from page content. This is a classic UI misrepresentation weakness rather than a memory safety or code execution flaw.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page containing a <select> element wired to a handler that requests fullscreen. When the user clicks the element, the page enters fullscreen without visible warning. The page then draws a fake Arc address bar showing a trusted domain such as a bank or single sign-on provider. Any credentials, tokens, or payment data submitted on the spoofed page flow to the attacker. Full technical detail is provided in the Arc Security Bulletin for CVE-2026-94181.

Detection Methods for CVE-2026-94181

Indicators of Compromise

User reports of unexpected fullscreen transitions triggered by clicking dropdowns or menus on unfamiliar sites
Web content that programmatically calls element.requestFullscreen() inside <select> event handlers
Phishing landing pages that render pixel-accurate copies of browser chrome for common identity providers

Detection Strategies

Inspect proxy or secure web gateway logs for pages hosting scripts that invoke the Fullscreen API from <select> handlers targeting authentication portals
Correlate DNS and HTTP telemetry for lookalike domains serving pages that mimic banking, SaaS, or SSO login flows
Hunt browser telemetry for Arc versions predating the vendor fix noted in the Arc security bulletin

Monitoring Recommendations

Track Arc browser version inventory across managed endpoints and flag builds prior to the patched release
Monitor phishing intelligence feeds for campaigns leveraging fullscreen address bar spoofing techniques
Alert on credential submissions from browser sessions to domains that do not match the address the user believes they visited

How to Mitigate CVE-2026-94181

Immediate Actions Required

Update Arc to the version identified as fixed in the Arc Security Bulletin for CVE-2026-94181
Verify browser auto-update is enabled across managed endpoints
Communicate to end users that pressing Esc exits fullscreen and reveals real browser chrome

Patch Information

The Browser Company addressed CVE-2026-94181 by restoring the fullscreen notification for transitions initiated through <select> elements. Deployment details and the fixed version are documented in the vendor advisory linked above. Apply the update on all systems running Arc.

Workarounds

Instruct users to press Esc when any page unexpectedly enters fullscreen and to re-verify the address bar before entering credentials
Restrict browsing to trusted sites through URL filtering until the patched Arc build is deployed
Enforce phishing-resistant authentication such as FIDO2 hardware keys so spoofed address bars cannot harvest reusable credentials

bash

# Verify installed Arc version on macOS endpoints
/usr/bin/mdls -name kMDItemVersion /Applications/Arc.app

# Compare against the fixed version noted in the Arc security bulletin
# https://arc.net/security/bulletins