CVE-2026-12348 Address Bar Spoofing in Arc Search for Android (window.open race condition)
Remote attackers can spoof the address bar in Arc Search for Android to display trusted domains while rendering malicious content, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-12348?
CVE-2026-12348 is a high-severity vulnerability in The Browser Company of New York` Arc Search, published on 16 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.
Weakness: CWE-1021
Which versions are affected by CVE-2026-12348?
How do I fix CVE-2026-12348?
No fix has been published for CVE-2026-12348 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12348 being exploited?
There is no known exploitation of CVE-2026-12348 in the wild and no public exploit code.
Sources
Also known as GHSA-84mw-63cf-6g24.