MinorCritical vulnerability

CVE-2026-94181 (CVSS 7.4)

NVD · officialPublished Sep 23, 2026Risk 23/100EPSS 0.3%

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

Technical details

CVSS

7.4

AV:NetworkAC:LowPR:NoneUI:RequiredC:NoneI:HighA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source