The Browser Company of New York — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by The Browser Company of New York (bcny). https://vulnogram.org/seaview/icons/bcny.png The Browser Company of New York — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-94183 · 7.4 HIGH 🌩️ — Address bar spoofing risk in affected Android versions of Arc Search https://vulnogram.org/CVE-2026-94183 https://vulnogram.org/CVE-2026-94183 Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake… High Network Exploitable Wed, 23 Sep 2026 19:02:02 GMT CVE-2026-94181 · 7.4 HIGH 🌩️ — Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element https://vulnogram.org/CVE-2026-94181 https://vulnogram.org/CVE-2026-94181 An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification. High Network Exploitable Wed, 23 Sep 2026 18:55:08 GMT CVE-2026-18534 · 7.4 HIGH 🌩️ — Address bar spoofing risk in affected iOS versions of Arc Search https://vulnogram.org/CVE-2026-18534 https://vulnogram.org/CVE-2026-18534 ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk. High Network Exploitable Tue, 18 Aug 2026 14:57:22 GMT CVE-2026-12348 · 7.4 HIGH 🌩️ — Address Bar Spoofing in Arc Search for Android (window.open race condition) https://vulnogram.org/CVE-2026-12348 https://vulnogram.org/CVE-2026-12348 Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing. High Network Exploitable Tue, 16 Jun 2026 19:54:06 GMT CVE-2026-2378 · 7.4 HIGH 🌩️ — Address bar spoofing risk in ArcSearch on Android https://vulnogram.org/CVE-2026-2378 https://vulnogram.org/CVE-2026-2378 ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content. High Network Exploitable Fri, 20 Mar 2026 21:16:51 GMT CVE-2025-15032 · 7.4 HIGH 🌩️ — CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank https://vulnogram.org/CVE-2025-15032 https://vulnogram.org/CVE-2025-15032 Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site. High Network Exploitable Fri, 16 Jan 2026 18:11:32 GMT CVE-2025-14809 · 7.4 HIGH 🌩️ — Address bar spoofing risk in ArcSearch on Android https://vulnogram.org/CVE-2025-14809 https://vulnogram.org/CVE-2025-14809 ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content. High Network Exploitable Fri, 19 Dec 2025 16:39:29 GMT CVE-2025-14812 · 7.5 HIGH 🌩️ — Address bar spoofing risk in Arc Search on iOS https://vulnogram.org/CVE-2025-14812 https://vulnogram.org/CVE-2025-14812 ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk. High Network Exploitable Fri, 19 Dec 2025 16:38:58 GMT CVE-2025-13132 · 7.4 HIGH 🌩️ — Dia: Increased Spoof Risk; Missing full screen toast https://vulnogram.org/CVE-2025-13132 https://vulnogram.org/CVE-2025-13132 This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a f… High Network Exploitable Fri, 21 Nov 2025 17:55:52 GMT