« Volver al listado

CVE-2026-2378

Estado: AnalizadaMedia (6.5)—

ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thebrowser — ARC Search

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2378",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2378",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-23T14:12:56.298860Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "affectedData": [
        {
          "vendor": "The BrowserCompany of New York",
          "product": "ArcSearch",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.12.7",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Android"
          ],
          "packageName": "company.thebrowser.arc",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-20T22:16:27.497",
  "references": [
    {
      "url": "https://arc.net/security/bulletins",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content."
    },
    {
      "lang": "es",
      "value": "ArcSearch para versiones de Android anteriores a la 1.12.7 podría mostrar un dominio diferente en la barra de direcciones al contenido que se mostraba, permitiendo la suplantación de la barra de direcciones después de la interacción del usuario mediante contenido web manipulado."
    }
  ],
  "lastModified": "2026-06-17T10:30:52.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thebrowser:arc_search:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E59F856-9B31-43D7-9969-9281627E6DEC",
              "versionEndExcluding": "1.12.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
}