CVE-2026-94181 - Vulnerability Details - OpenCVE

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
The Browser Company Of New York	Arc

No data.

No data.

References

Link	Providers
https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element
https://hackerone.com/reports/3711701

History

Thu, 24 Sep 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		The Browser Company Of New York The Browser Company Of New York arc
Vendors & Products		The Browser Company Of New York The Browser Company Of New York arc

Wed, 23 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 23 Sep 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
Title		Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
Weaknesses		CWE-451
References		https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element https://hackerone.com/reports/3711701
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: BCNY

Published: 2026-09-23T18:55:08.973Z

Updated: 2026-09-23T19:35:35.801Z

Reserved: 2026-09-21T00:50:04.410Z

Link: CVE-2026-94181

Vulnrichment

Updated: 2026-09-23T19:35:33.654Z

NVD

Status : Awaiting Analysis

Published: 2026-09-23T19:19:48.763

Modified: 2026-09-24T19:36:39.327

Link: CVE-2026-94181

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94181", "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "state": "PUBLISHED", "assignerShortName": "BCNY", "dateReserved": "2026-09-21T00:50:04.410Z", "datePublished": "2026-09-23T18:55:08.973Z", "dateUpdated": "2026-09-23T19:35:35.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "shortName": "BCNY", "dateUpdated": "2026-09-23T18:55:08.973Z"}, "title": "Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element", "datePublic": "2026-09-23T18:48:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "affected": [{"vendor": "The Browser Company of New York", "product": "Arc", "platforms": ["MacOS"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.159.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <code><select></code> element that triggers requestFullscreen without displaying the fullscreen notification."}]}], "references": [{"url": "https://hackerone.com/reports/3711701"}, {"url": "https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T19:35:29.822010Z", "id": "CVE-2026-94181", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T19:35:35.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94181", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-23T19:35:29.822010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T19:35:33.654Z"}}], "cna": {"title": "Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Browser Company of New York", "product": "Arc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.159.0", "versionType": "semver"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "datePublic": "2026-09-23T18:48:00.000Z", "references": [{"url": "https://hackerone.com/reports/3711701"}, {"url": "https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.", "supportingMedia": [{"type": "text/html", "value": "An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <code><select></code> element that triggers requestFullscreen without displaying the fullscreen notification.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "shortName": "BCNY", "dateUpdated": "2026-09-23T18:55:08.973Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94181", "state": "PUBLISHED", "dateUpdated": "2026-09-23T19:35:35.801Z", "dateReserved": "2026-09-21T00:50:04.410Z", "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "datePublished": "2026-09-23T18:55:08.973Z", "assignerShortName": "BCNY"}, "dataVersion": "5.2"}