CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search
Attackers can spoof browser interface elements in Arc Search for iOS by hiding the address bar, potentially deceiving users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-18534?
CVE-2026-18534 is a high-severity vulnerability in The Browser Company of New York ArcSearch, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
Weakness: CWE-1021
Which versions are affected by CVE-2026-18534?
How do I fix CVE-2026-18534?
No fix has been published for CVE-2026-18534 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18534 being exploited?
There is no known exploitation of CVE-2026-18534 in the wild and no public exploit code.
Sources
Also known as GHSA-9gwv-2w2h-phfh.