« Volver al listado

CVE-2026-94183

Estado: Pendiente de análisisAlta (7.4)—

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Explotación para cliente mediante sitio web malicioso que manipula UI fullscreen sin notificación visible (T1203). Impacto: phishing mediante spoofing de barra de direcciones (T1566.002) e ingeniería social (T1598.003).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingSoftware ConfigurationUser Account ManagementRestrict Web-Based ContentAuditApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Thebrowser — ARC SearchAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-94183",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-94183",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-23T19:31:42.640596Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "affectedData": [
        {
          "vendor": "The Browser Company of New York",
          "product": "Arc Search",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.12.10",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-23T20:17:23.907",
  "references": [
    {
      "url": "https://arc.net/security/bulletins#cve-2026-94183-address-bar-spoof-risk-missing-fullscreen-notification-on-return-from-background",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
    },
    {
      "url": "https://hackerone.com/reports/3572193",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing."
    }
  ],
  "lastModified": "2026-09-24T19:36:39.327",
  "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
}