CVE-2026-94181CWE-451

CVE-2026-94181

High · published September 23, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2026-09-23T23:19Z
References (2)
https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element · 59469e6c-7ea7-446f-8e43-06aa32c115e8https://hackerone.com/reports/3711701 · 59469e6c-7ea7-446f-8e43-06aa32c115e8
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 18:55Z
    Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
    cvelistv5