Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

Arc browser can hide fullscreen notice, spoof address bar

CVE-2026-94181 · published 1 month ago
Summary

Certain versions of the Arc web browser let a web page use a dropdown menu to enter fullscreen mode without showing the normal warning. This can make the page copy the address bar, potentially tricking users into believing they are on a legitimate site. Update Arc to the latest version or apply the vendor's recommended fix to stop this behavior.

What to do
  • Update the browser company of new york arc to version 1.159.0 or later.
Affected software
VendorProductAffected versions
the browser company of new york arc < 1.159.0
Original advisory text
Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-451User Interface (UI) Misrepresentation of Critical Information
Timeline
Published23 Sep 2026
Updated4 Nov 2026
First seen23 Sep 2026
Sources
CVE-2026-94181 · NVD
CVE-2026-94181 · MITRE
Track software like this
Free during beta