CVE-2026-18534: The Browser Company Of New York Arcsearch

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

Affected products

• The Browser Company Of New York Arcsearch: before 1.48.0 (fixed in 1.48.0)

Published 2026-08-18. Last modified 2026-09-03.