CVE-2026-12348: The Browser Company Of New York` Arc Search

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.

Affected products

• The Browser Company Of New York` Arc Search

Published 2026-06-17. Last modified 2026-06-17.