CVE Watch24 sept 2026

CVE-2026-94183

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is

CVSS

7.4

Alto

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Publicado: 23 sept 2026 · Última mod.: 24 sept 2026 · CWE-451

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-09-242026-10-20

Descripción técnica

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1094344.3 MED

21.6%

——6Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.2d CVE-2026-1097477.3 ALT

19.5%

——6Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.2d CVE-2026-1097368.1 ALT

24.0%

——7Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.2d CVE-2026-1093468.1 ALT

19.1%

——6better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.5d CVE-2026-1063805.4 MED

10.7%

——3UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)15d CVE-2026-1063685.4 MED

9.0%

——3UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)7d