CVE-2026-18534— Address bar spoofing risk in affected iOS versions of Arc Search
Quick assessment
Affected
The Browser Company of New York ArcSearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ArcSearch for iOS 1.48.0 之前的版本在页面发起滚动后可能会保持地址栏隐藏，使得攻击者能够控制的内容模仿浏览器界面元素，从而增加了模拟攻击的风险。
Possible ATT&CK Techniques 1 AI
T1555.003 · Credentials from Web BrowsersAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The Browser Company of New York | ArcSearch | < 1.48.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18534
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Address bar spoofing risk in affected iOS versions of Arc Search
Source: CVE Program / CVE List V5
Vulnerability Description
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不当限制渲染UI层或帧
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| The Browser Company of New York | ArcSearch | 0 ~ 1.48.0 | - |
|
II. Public POCs for CVE-2026-18534
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18534
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18534 (1)
IV. Related Vulnerabilities
Same vendor: The Browser Company of New York
Same weakness: CWE-1021
-
CVE-2026-44762
Security Misconfiguration in SAP Data Services Management Co -
CVE-2026-70600
Electron: Cross-origin iframe can position native autofill p -
CVE-2026-47723
nebula-mesh: Web UI and API responses lack security headers -
CVE-2026-58595
Microsoft Bing App for IOS Spoofing Vulnerability -
CVE-2026-59791
JetBrains YouTrack 处理逻辑错误漏洞
V. Comments for CVE-2026-18534
No comments yet