CVE-2026-94181: Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
Published Sep 23, 2026
·Updated
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
Affected Software
1 affected component
The Browser Company Arc
Event History
Sep 23, 2026
CVE Published
via MITRE·06:55 PM
Data Sourced
via MITRE·06:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What interaction does an attacker need to exploit this issue?
The attacker would need to get a user to interact with a malicious page, because the issue requires user interaction. The page uses a select element to trigger requestFullscreen and can then spoof the browser address bar without showing the fullscreen notification.
2
What is the practical impact of successful exploitation?
An attacker can make the browser address bar appear to show misleading information, potentially helping a malicious site impersonate a trusted site. The provided severity vector indicates high integrity impact, with no stated confidentiality or availability impact.