CVE-2026-94183

Executive Summary

CVE-2026-94183 is a user-interface spoofing vulnerability in Arc Search for Android in versions prior to 1.12.10. When a web page enters fullscreen mode while the application is backgrounded, the app fails to display a fullscreen notification, allowing a remote attacker operating a specially crafted website to render fake UI elements — such as a spoofed address bar — and mislead the user about the origin of displayed content. The flaw carries a CVSS v3.1 base score of 7.4 (High) with a scope change, and increases the risk of phishing and origin-spoofing attacks against affected users.

Technical Analysis

The vulnerability is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. This weakness class covers situations where an application fails to properly present security-relevant state to the user, causing the user to form an incorrect mental model of what they are interacting with.

In this case, the specific mechanism described by NVD is precise but narrow: Arc Search for Android, before version 1.12.10, "does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background." Modern mobile browsers are expected to surface a persistent, browser-controlled notification when a web page transitions into fullscreen mode, precisely so that the user retains an unambiguous, trusted indicator of the browser context and the origin of the content being viewed. The Fullscreen API permits web content to occupy the entire display; without a competently rendered notification, in-page attacker-controlled content can visually approximate browser chrome.

The attack surface is the normal public web browsing path. An attacker does not need any privileged position, network adjacency, or authentication. They need only control (or compromise) a website the victim visits, and then cause that page to enter fullscreen mode under conditions where the app is backgrounded. The "background" condition is the critical trigger state described — it is the state in which the expected notification is omitted.

Two components interact:

1. The attacker-controlled page, which enters fullscreen mode and paints UI elements that imitate trusted browser interface (e.g., an address bar).
2. The Arc Search application, which under the described background-state condition fails to overlay its own fullscreen notification, so the user has no trustworthy browser-controlled indicator distinguishing real chrome from page-rendered content.

Because the misrepresentation concerns what the user believes about content origin, the integrity impact is rated High (I:H) while confidentiality and availability impacts are rated None (C:N/A:N). The scope is changed (S:C), reflecting that the vulnerable component's failure impacts a security property (user perception of origin) that lies outside the normally assumed trust boundary of rendered web content. The attack vector is network (AV:N), complexity low (AC:L), no privileges required (PR:N), and user interaction required (UI:R) — the victim must visit the page and the fullscreen/background transition must occur.

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE. All exploitation characterization here is inferred from the vulnerability class (UI misrepresentation / fullscreen notification omission) and the NVD description. No function names, class names, or internal identifiers beyond those stated in the NVD description are asserted.

Exploitation Scenarios

The following chain is derived strictly from the NVD description and the CWE-451 class. It describes the attack at the vulnerability-class level; no specific implementation details beyond the description are claimed.

1. Reconnaissance / target identification. The attacker identifies users of Arc Search for Android running a version below 1.12.10. Because exploitation requires the victim to load an attacker-controlled page inside the affected browser, the practical targeting vector is any channel that drives traffic to an attacker-owned site: phishing links, malvertising, malicious redirects, or a compromised legitimate site. The attacker also needs to arrange for the app to be in the background when the fullscreen transition occurs.

2. Triggering the flaw class. The victim is lured to the crafted website. The page enters fullscreen mode using standard web-platform fullscreen functionality while the application is running in the background. Per the description, the app fails to display the expected fullscreen notification in this state.

3. Payload / execution at the vulnerability-class level. With the browser-controlled notification absent, the attacker's page renders content that visually imitates trusted UI — the NVD description specifically names a spoofed address bar as an example. The user is thus shown a fabricated browser context (for example, a URL that appears legitimate) above or around attacker-controlled page content. This is a UI-misrepresentation payload: no memory corruption, code execution, or privilege escalation is involved or claimed; the "payload" is deceptive rendered interface.

4. Post-exploitation impact. The user, misled about the origin of the displayed content, is more likely to trust and interact with it — entering credentials, approving transactions, or following instructions — because the spoofed interface implies a trusted origin. The impact is integrity of user perception (phishing enablement), not direct code execution or data exfiltration by the flaw itself. Any credential or data disclosure results from the user's deceived interaction, and the CVSS vector reflects this by rating I:H with C:N/A:N.

Note: No public PoC is available; this attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

CVSS v3.1 base score: 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.

Subscore interpretation:

• AV:N (Network) — exploitation is possible remotely over the internet; no local or adjacent access is needed.
• AC:L (Low) — no special conditions beyond those described are required to trigger the flaw.
• PR:N (None) — no authentication or privileges are required by the attacker.
• UI:R (Required) — the victim must visit the crafted page and the described fullscreen/background condition must occur; this is the principal friction reducing exploitability.
• S:C (Changed) — the failure affects a security property (trusted origin indication) beyond the vulnerable component's own scope.
• C:N — the flaw does not directly disclose information.
• I:H — high integrity impact: the user's perception of content origin is corrupted, directly enabling phishing.
• A:N — no availability impact.

Blast radius: all Arc Search for Android installations below version 1.12.10. Impact is per-user (phishing success depends on individual victim interaction), so this is not a wormable or self-propagating issue. Business impact concentrates on credential theft, session hijacking via phishing, and downstream account compromise where users are deceived into entering data into spoofed interfaces. Organizations whose workforce uses the affected app on managed or BYO Android devices should treat this as a client-side phishing-amplification risk rather than a server-side compromise vector. CISA KEV status: NO — no known active exploitation in the wild is recorded. EPSS: not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Arc Search Android Fullscreen Notification Omission - UI Spoofing Precursor
id: 3f2a9c1e-7b64-4d2a-9e10-arcsearch94183
status: experimental
description: Detects mobile application log or MDM telemetry indicating Arc Search for Android below 1.12.10 entering fullscreen while backgrounded, consistent with CVE-2026-94183 UI spoofing attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94183
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: android
detection:
  selection_app:
    app_name|contains: 'Arc Search'
  selection_version:
    app_version|lt: '1.12.10'
  selection_event:
    event_type|contains:
      - 'fullscreen'
      - 'fullscreen_enter'
  condition: selection_app and selection_version and selection_event
falsepositives:
  - Legitimate fullscreen media playback on patched versions
  - Version telemetry gaps where app_version is unavailable
level: medium
tags:
  - attack.t1190
  - cve.2026.94183
  - cwe.451

YARA Rule

rule CVE_2026_94183_ArcSearch_FullscreenSpoof
{
    meta:
        description = "Detects artifacts consistent with UI-spoofing pages targeting the Arc Search for Android fullscreen notification omission (CVE-2026-94183)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94183"
        cve = "CVE-2026-94183"

    strings:
        $fs1 = "requestFullscreen" ascii nocase
        $fs2 = "webkitRequestFullscreen" ascii nocase
        $fs3 = "fullscreenchange" ascii nocase
        $ui1 = "address bar" ascii nocase
        $ui2 = "location.href" ascii nocase
        $ui3 = "spoof" ascii nocase

    condition:
        (any of ($fs*)) and (any of ($ui*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94183 Arc Search Android Fullscreen UI Spoofing Page Load"; flow:established,to_client; http.header; content:"User-Agent"; nocase; content:"Arc"; nocase; http.response_body; content:"requestFullscreen"; nocase; content:"fullscreenchange"; nocase; reference:cve,2026-94183; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94183; classtype:attempted-user; sid:9418301; rev:1;)

Elastic Detection

sequence by user.name, host.name with maxspan=30s
  [ network where process.name in ("Arc", "com.arc.search") and
      dns.question.name != null ]
  [ file where event.action in ("creation", "modification") and
      file.name : "*.html" and process.name in ("Arc", "com.arc.search") ]

Splunk SPL Query

index=mobile OR index=mdm sourcetype=android:applog
| search app_name="Arc Search" app_version!="1.12.10"
| where isnull(app_version) OR app_version < "1.12.10"
| search (event_type="fullscreen_enter" OR event_type="fullscreenchange" OR message="*fullscreen*")
| stats count min(_time) as first_seen max(_time) as last_seen by user, device_id, app_version, url_domain
| where count > 0
| eval risk="CVE-2026-94183 potential UI spoofing exposure"
| sort - count

Wazuh OSSEC Rule

<group name="android,arc_search,cve_2026_94183,">
  <rule id="941830" level="7">
    <decoded_as>json</decoded_as>
    <field name="app_name">Arc Search</field>
    <field name="event_type">fullscreen_enter</field>
    <description>CVE-2026-94183: Arc Search Android entered fullscreen while backgrounded - possible UI spoofing page</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94183,ui_spoofing,</group>
  </rule>
  <rule id="941831" level="4">
    <decoded_as>json</decoded_as>
    <field name="app_name">Arc Search</field>
    <field name="app_version" type="pcre2">^1\.(?:[0-9]|1[01])\.</field>
    <description>CVE-2026-94183: Arc Search Android version below 1.12.10 detected on device</description>
    <group>cve_2026_94183,vulnerable_version,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source (no vendor advisory, no OSV entry, no fixed-version confirmation beyond the NVD description's stated fixed version of 1.12.10). No CISA KEV entry.

1. Immediate mitigations

• Because NVD states the flaw is resolved in version 1.12.10, treat 1.12.10 as the minimum acceptable build. Where that build is not yet available in a managed environment, restrict use of the affected app for sensitive workflows and require users to complete authentication or payments only in applications that display a trustworthy browser/fullscreen indicator.
• Educate users that browser chrome can be spoofed in this class of issue and to verify URLs through independent means (bookmark, manually typed address) rather than visual appearance.
• Where feasible in a managed mobile environment, apply policy restrictions that limit access to untrusted web content through the affected app until 1.12.10 is deployed.

2. Patch / upgrade steps

• Confirm the installed Arc Search for Android version from the app store listing or device application settings.
• If the installed version is below 1.12.10, update to 1.12.10 or later as soon as it is distributable in your region and channel.
• Verify the update through MDM/app-inventory telemetry; do not rely on user self-report.
• If 1.12.10 is not obtainable, escalate to the vendor and document the residual risk.

3. Long-term hardening

• Maintain an inventory of browser and search applications on managed Android devices and track their versions centrally.
• Adopt a policy of minimum-version enforcement for browsers, given the elevated trust users place in browser interface elements.
• Include UI-misrepresentation classes (CWE-451) in client-application risk reviews; they frequently carry high integrity impact with low exploitation friction.
• Monitor for future updates to CVE-2026-94183, including any vendor advisory or CISA KEV addition, and re-assess if active exploitation is reported.

References

• NVD — CVE-2026-94183: https://nvd.nist.gov/vuln/detail/CVE-2026-94183
• CWE-451 — User Interface (UI) Misrepresentation of Critical Information: https://cwe.mitre.org/data/definitions/451.html
• FIRST EPSS (CVE not yet scored as of this report): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94183 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor campaigns / exploit-in-the-wild evidence: none recorded. No public PoC, exploit code, or Nuclei template is known, and CISA KEV does not list this CVE.