CVE-2026-94181

Executive Summary

CVE-2026-94181 is an address bar spoofing vulnerability in the Arc web browser that allows an attacker to falsify the visible URL by abusing a <select> element to trigger requestFullscreen without displaying the mandatory fullscreen notification. The flaw carries a CVSS score of 7.4 (High) and requires user interaction, with the browser's own UI trust boundary being compromised (Scope: Changed). No public exploit, PoC, or Nuclei template exists at this time, and no patch has been identified.

Technical Analysis

This vulnerability is classified as CWE-451: User Interface (UI) Misrepresentation of Critical Information. The core mechanism involves the browser's fullscreen API and its user-notification requirement. Per the W3C Fullscreen API specification and browser implementations such as Chromium, entering fullscreen mode via requestFullscreen() must present a visible notification (e.g., "Press ESC to exit fullscreen") or an equivalent UI indicator to prevent spoofing attacks where a malicious page can mimic browser chrome.

In Arc's affected versions, a <select> HTML element is used as the trigger vector. When a <select> element initiates a fullscreen request, the browser fails to display the required fullscreen notification. This creates a window of opportunity for an attacker to render a fake address bar or browser UI within the fullscreen viewport. Because the fullscreen notification is absent, the user has no visual cue that they are viewing attacker-controlled content rather than legitimate browser chrome.

The CVSS vector indicates:

• Attack Vector (Network): The attack is delivered over the network, typically via a malicious webpage.
• Attack Complexity (Low): No special conditions are required beyond a user visiting a page.
• Privileges Required (None): The attacker does not need any prior access.
• User Interaction (Required): The victim must interact with the malicious page, likely by clicking or selecting an option within the <select> element.
• Scope (Changed): The vulnerability impacts resources beyond the vulnerable component — the browser's UI trust boundary is breached.
• Confidentiality (None): No direct data confidentiality impact is specified.
• Integrity (High): The spoofed address bar directly undermines the integrity of the browser's security indicators.
• Availability (None): No availability impact.

The attack surface is the Arc browser's implementation of the Fullscreen API and its handling of <select> elements. The flaw likely stems from a logic error where the fullscreen notification is conditionally skipped when the fullscreen request originates from a <select> element, perhaps due to a rendering or event-handling edge case.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred from the vulnerability class (UI misrepresentation via fullscreen API) and the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies users of vulnerable Arc browser versions. This is a client-side attack, so the attacker does not scan for a service but rather crafts a malicious webpage or injects malicious content into a legitimate site.

2. Triggering the Flaw: The victim navigates to the attacker-controlled page. The page contains a crafted <select> element. When the user interacts with this element (e.g., clicks it to open the dropdown), the page's JavaScript calls requestFullscreen() on an element. Due to the vulnerability, Arc enters fullscreen mode without showing the required notification. The exact JavaScript pattern is not specified in the available data, but the mechanism is the <select>-triggered fullscreen request.

3. Payload/Execution Method: Once in fullscreen mode without the notification, the attacker renders a fake browser UI — including a spoofed address bar — within the fullscreen viewport. This fake UI can display a trusted URL (e.g., https://bank.example.com), deceiving the user into believing they are on a legitimate site. The user may then enter credentials or other sensitive information into a phishing form displayed by the attacker.

4. Post-Exploitation Impact: The primary impact is credential theft, session hijacking, or malware download via a spoofed trusted domain. The user's trust in the browser's address bar is subverted, enabling convincing phishing attacks. The CVSS integrity impact is High, reflecting the compromise of the browser's security UI.

Impact Assessment

The vulnerability affects users of the Arc browser. Because it is a client-side flaw, the blast radius is limited to individual users who visit a malicious page or interact with a malicious <select> element. However, the impact per user can be severe: stolen credentials, financial fraud, or malware infection. The CVSS score of 7.4 reflects a High severity, driven by the Changed Scope and High Integrity impact. The absence of Confidentiality and Availability impacts suggests the attack is primarily aimed at deception rather than direct data exfiltration or denial of service, though stolen credentials can lead to further compromise.

Business impact includes:

• Phishing attacks that bypass traditional URL inspection by users.
• Potential for targeted attacks against employees of specific organizations.
• Reputational damage if the browser is used in enterprise environments.
• Need for user awareness training and browser hardening.

Since no patch is available, Arc users remain at risk until the vendor releases a fix.

Detection Guidance

Sigma Rule

title: Arc Browser Address Bar Spoofing via Select Element Fullscreen
id: 4f8a2b1c-9d3e-4a5f-8b7c-1e2d3f4a5b6c
status: experimental
description: Detects potential exploitation of CVE-2026-94181 where a select element triggers fullscreen without notification, leading to address bar spoofing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94181
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\Arc.exe'
    CommandLine|contains: '--enable-features=FullscreenWithoutNotification'
  condition: selection
falsepositives:
  - Legitimate use of debugging flags
level: high

YARA Rule

rule CVE_2026_94181_Arc_AddressBar_Spoofing
{
    meta:
        description = "Detects HTML/JS patterns attempting to exploit CVE-2026-94181 by combining select elements with fullscreen requests"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94181"
        severity = "high"

    strings:
        $select = "<select" ascii wide nocase
        $fullscreen1 = "requestFullscreen" ascii wide nocase
        $fullscreen2 = "webkitRequestFullscreen" ascii wide nocase
        $fullscreen3 = "mozRequestFullScreen" ascii wide nocase
        $fullscreen4 = "msRequestFullscreen" ascii wide nocase

    condition:
        $select and any of ($fullscreen*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94181 Arc Address Bar Spoofing Attempt"; flow:to_client,established; content:"<select"; http_server_body; nocase; content:"requestFullscreen"; http_server_body; nocase; distance:0; within:500; sid:10000001; rev:1; reference:cve,2026-94181; classtype:attempted-user; metadata:affected_product Arc_Browser, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_01_01, cve CVE_2026_94181;)

Elastic Detection

process where event.type == "start" and process.name == "Arc.exe" and
  process.command_line : "*--enable-features=FullscreenWithoutNotification*"

Splunk SPL Query

index=proxy OR index=web
| search (url="*<select*" OR url="*requestFullscreen*")
| rex field=url "(?<select_tag><select[^>]*>)"
| rex field=url "(?<fullscreen_call>requestFullscreen|webkitRequestFullscreen|mozRequestFullScreen|msRequestFullscreen)"
| where isnotnull(select_tag) AND isnotnull(fullscreen_call)
| stats count by src_ip, dest_host, url
| where count > 0

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="100100" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*(<select|requestFullscreen|webkitRequestFullscreen|mozRequestFullScreen|msRequestFullscreen).*</field>
    <description>CVE-2026-94181: Potential Arc address bar spoofing attempt detected</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable or restrict the use of the Arc browser in enterprise environments until a patch is available.
   • Educate users about the risks of interacting with unexpected fullscreen prompts and the importance of verifying the address bar.
   • Consider deploying browser extensions or security tools that alert on fullscreen transitions.
   • If Arc must be used, enforce a policy that blocks JavaScript execution on untrusted sites.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor the Arc browser's official release notes and security advisories for updates addressing CVE-2026-94181.
   • Once a patch is released, immediately upgrade all Arc installations to the fixed version.

3. Long-term Hardening:

   • Implement a vulnerability management program that includes browser security updates.
   • Use application allowlisting to prevent unauthorized browsers.
   • Conduct regular phishing simulations that include fullscreen-based attacks.
   • Advocate for browser vendors to adopt stricter fullscreen notification controls.

References

1. NVD — CVE-2026-94181: https://nvd.nist.gov/vuln/detail/CVE-2026-94181
2. CWE-451: User Interface (UI) Misrepresentation of Critical Information — https://cwe.mitre.org/data/definitions/451.html
3. W3C Fullscreen API Specification — https://fullscreen.spec.whatwg.org/
4. Arc Browser Official Website — https://arc.net/
5. MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/

No known threat actor campaigns or exploit-in-the-wild evidence exists at the time of writing. CISA KEV catalog does not list this CVE.