Arc Browser: Omnibar Spoofing, Privilege Escalation & iframe URI Risks on Android/iOS/Mac/Win

The following is a summary of key vulnerability information compiled from webpage screenshots: --- CVE-2026-12348: Arc Search for Android Address Bar Spoofing Vulnerability Vulnerability Overview: In Arc Search for Android, the address bar may display a domain name different from the current content, posing a risk of address bar spoofing. Affected Range: Arc Search for Android versions < 1.12.9. Remediation: Update Arc Search for Android to the latest version (≥ 1.12.9). Severity: High (CVSS v3.1 Base Score: 7.4). Reporter: alfazhossain (via Vulnerability Reward Program). --- CVE-2026-2378: ArcSearch Android Omnibar Spoofing Vulnerability Vulnerability Overview: In Arc Search for Android, the address bar may display a domain name different from the current content, posing a risk of address bar spoofing. Affected Range: Arc Search for Android versions < 1.12.7. Remediation: Update Arc Search for Android to the latest version (≥ 1.12.7). Severity: High (CVSS v3.1 Base Score: 7.4). Reporter: moch_azril (via Vulnerability Reward Program). --- CVE-2025-14809: ArcSearch (Android) Address Bar Spoofing Risk Vulnerability Overview: In Arc Search for Android, the address bar may display a domain name different from the current content, posing a risk of address bar spoofing. Affected Range: Arc Search for Android versions < 1.12.6. Remediation: Update Arc Search for Android to the latest version (≥ 1.12.6). Severity: High (CVSS v3.1 Base Score: 7.4). Reporter: moch_azril (via Vulnerability Reward Program). --- CVE-2025-14812: Arc Search (iOS) iframe-triggered URI Navigation Spoofing Risk Vulnerability Overview: In Arc Search for iOS, URI scheme navigation triggered by an iframe may cause the address bar to display a domain name different from the current content, posing a risk of address bar spoofing. Affected Range: Arc Search for iOS versions < 1.45.2. Remediation: Update Arc Search for iOS to the latest version (≥ 1.45.2). Severity: High (CVSS v3.1 Base Score: 7.5). Reporter: syari07 (via Vulnerability Reward Program). --- Windows Site Settings Bypass - CVE-2024-52928 Vulnerability Overview: Arc on Windows has a vulnerability in handling site permissions, allowing websites to automatically request new permissions and bypass those explicitly granted by the user. Affected Range: Arc on Windows versions ≤ 1.26.0. Remediation: Update Arc on Windows to version ≥ 1.26.1. Reporter: Bharat(mn0ob). --- JavaScript Boost Full Disk Access Vulnerability Vulnerability Overview: In Arc on Mac, the JavaScript Boost feature within the Easel functionality may lead to full disk access. Affected Range: Arc on Mac versions ≤ 1.66.0. Remediation: Remove the JavaScript Boost feature from Easel and update Arc on Mac to the latest version. Reporter: ReinzaXZ3. --- Easel URL Embed Issue - CVE Pending Vulnerability Overview: The Easel feature in Arc has a URL embedding vulnerability that may result in the display of malicious content. Affected Range: All Arc users utilizing the Easel feature. Remediation: Update Arc to the latest version to ensure backend validation and URL filtering mechanisms are effective. Reporter: Not specified. --- The above constitutes a summary of key vulnerability information from the webpage screenshots.

Goal Reached Thanks to every supporter — we hit 100%!

Arc Browser: Omnibar Spoofing, Privilege Escalation & iframe URI Risks on Android/iOS/Mac/Win