CVE-2026-12348

Address Bar Spoofing in Arc Search for Android (window.open race condition) PUBLISHED

Description (CNA)

Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.

Affected (CNA)

Vendor / product	Versions
The Browser Company of New York` / Arc Search	unaffected 0 through 1.12.8

CWE

CWE-1021

References

https://hackerone.com/reports/3705306

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.