Skip to content
OpenAdvisories
High · 7.4 CVE-2026-12348 EUVD-2026-37290GHSA-84mw-63cf-6g24

Address Bar Spoofing in Arc Search for Android (window.open race condition)

Published Jun 16, 2026 · Updated Jun 17, 2026 · Assigned by BCNY

Description

Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.

Affected products

VendorProductAffectedFixed
The Browser Company of New York` Arc Search — —

References