CVE-2026-94183: Arc Search Android XSS Vulnerability

CVE-2026-94183 Overview

CVE-2026-94183 is an address bar spoofing vulnerability in Arc Search for Android versions prior to 1.12.10. The browser fails to display a fullscreen notification when a web page enters fullscreen mode while the app runs in the background. When the user returns to the app, a malicious page can render fake user interface elements, including a spoofed address bar. This allows a remote attacker to mislead users about the true origin of displayed content, enabling convincing phishing attacks. The flaw is classified as [CWE-451] User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
A crafted website can impersonate a trusted origin by drawing a fake browser chrome, tricking users into submitting credentials or sensitive data to attacker-controlled pages.

Affected Products

Arc Search for Android versions before 1.12.10
The Browser Company's Arc mobile browser (Android build)
Android devices running vulnerable Arc Search installations

Discovery Timeline

2026-09-23 - CVE-2026-94183 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database
Additional disclosure details available in the Arc Security Bulletin and HackerOne Report #3572193

Technical Details for CVE-2026-94183

Vulnerability Analysis

The vulnerability exists in how Arc Search for Android handles fullscreen transitions when the application is backgrounded. Modern mobile browsers display a transient notification when a page enters fullscreen mode to inform users that browser chrome will be hidden. Arc Search omits this notification when the fullscreen transition occurs while the app is in the background.

When the user returns to the app, the malicious page is already in fullscreen with no visible browser controls. The page can then render arbitrary HTML that mimics the address bar, TLS lock icon, and navigation controls. Users have no reliable indicator that the rendered chrome is untrusted content instead of the real browser UI.

Exploitation requires user interaction, such as visiting a crafted link. Because the spoofed chrome is drawn inside a scope-changed context, the impact extends beyond the vulnerable component to affect user trust in the entire browsing session. Successful exploitation supports credential phishing and misattribution of malicious content to trusted brands.

Root Cause

The root cause is a missing security notification in the fullscreen state transition handler. The code path that fires when the app returns from the background does not re-evaluate whether an active fullscreen session requires a user-facing warning. This omission violates the platform expectation that any transition into a chrome-less rendering state must be announced to the user.

Attack Vector

The attack proceeds over the network without authentication. An attacker hosts a page that requests fullscreen mode, then waits for the user to background the Arc Search app, for example by switching to another application or answering a call. When the user returns to Arc Search, the fullscreen page is presented without the standard notification. The malicious page renders spoofed browser UI, including a fake address bar showing a trusted domain, and prompts the user to enter credentials or other sensitive data. Technical details of the exploitation sequence are documented in HackerOne Report #3572193.

Detection Methods for CVE-2026-94183

Indicators of Compromise

Outbound HTTPS connections from Android devices to newly registered domains immediately after user interaction with links delivered via SMS, email, or messaging apps
Web page DOM structures containing elements styled to imitate Arc Search browser chrome, such as fixed-position bars at the top of the viewport
Phishing pages invoking the JavaScript Fullscreen API (Element.requestFullscreen()) followed by rendering of URL-like text elements
User reports of Arc Search sessions where the address bar appears frozen or does not update on navigation

Detection Strategies

Inspect mobile web traffic through a secure web gateway for pages that combine fullscreen API calls with credential input fields
Monitor mobile endpoint telemetry for installed Arc Search versions below 1.12.10
Correlate user-reported phishing incidents with the Arc Search user agent string to identify targeted campaigns

Monitoring Recommendations

Track Arc Search application version inventory across managed Android devices through mobile device management (MDM) platforms
Alert on DNS queries to lookalike domains impersonating banking, corporate SSO, or email providers originating from Android endpoints
Review URL filtering logs for high-risk categories accessed from Arc Search user agents

How to Mitigate CVE-2026-94183

Immediate Actions Required

Update Arc Search for Android to version 1.12.10 or later through the Google Play Store
Notify users through security awareness channels about address bar spoofing risks in mobile browsers
Enforce minimum application versions for Arc Search through mobile device management policies

Patch Information

The Browser Company addressed the vulnerability in Arc Search for Android version 1.12.10. The fix ensures that fullscreen notifications are displayed when the app returns from the background with an active fullscreen session. Refer to the Arc Security Bulletin for full remediation details.

Workarounds

Avoid backgrounding Arc Search while browsing untrusted sites until the update is installed
Verify site identity by exiting fullscreen mode manually before entering credentials or sensitive data
Use an alternative Android browser for high-value authentication flows until patched
Restrict installation of Arc Search on corporate managed Android devices to versions 1.12.10 and above through Google Play managed app configuration