Refine your search

4 vulnerabilities found for ArcSearch by The Browser Company of New York

CVE-2025-14812 (GCVE-0-2025-14812)
Vulnerability from nvd
Published
2025-12-19 16:38
Modified
2025-12-19 16:50
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Summary
ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.
References
Impacted products
Vendor Product Version
The Browser Company of New York ArcSearch Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T16:49:25.499181Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-19T16:50:33.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Address bar / Omnibox (address bar UI)"
          ],
          "platforms": [
            "iOS"
          ],
          "product": "ArcSearch",
          "vendor": "The Browser Company of New York",
          "versions": [
            {
              "lessThan": "1.45.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-12-19T16:39:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk."
            }
          ],
          "value": "ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-154",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-154 Resource Location Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T16:39:11.237Z",
        "orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "shortName": "BCNY"
      },
      "references": [
        {
          "url": "https://arc.net/security/bulletins#cve-2025-14812-address-bar-spoofing-risk-iframe-triggered-uri-navigation-on-arc-search-ios"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade ArcSearch on iOS to version 1.45.2 or newer."
            }
          ],
          "value": "Upgrade ArcSearch on iOS to version 1.45.2 or newer."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Address bar spoofing risk in Arc Search on iOS",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
    "assignerShortName": "BCNY",
    "cveId": "CVE-2025-14812",
    "datePublished": "2025-12-19T16:38:58.980Z",
    "dateReserved": "2025-12-16T23:26:11.126Z",
    "dateUpdated": "2025-12-19T16:50:33.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14809 (GCVE-0-2025-14809)
Vulnerability from nvd
Published
2025-12-19 16:39
Modified
2025-12-19 18:00
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CWE
  • CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Summary
ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
References
Impacted products
Vendor Product Version
The Browser Company of New York ArcSearch Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T17:23:52.793191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-19T18:00:13.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Address bar / Omnibox (address bar UI)"
          ],
          "platforms": [
            "Android"
          ],
          "product": "ArcSearch",
          "vendor": "The Browser Company of New York",
          "versions": [
            {
              "lessThan": "1.12.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-12-19T16:39:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.\u003c/p\u003e"
            }
          ],
          "value": "ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-154",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-154 Resource Location Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T16:39:29.458Z",
        "orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "shortName": "BCNY"
      },
      "references": [
        {
          "url": "https://arc.net/security/bulletins#cve-2025-14809-address-bar-spoofing-risk-navigation-trigger-uri-confusion-on-arcsearch-android"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade ArcSearch on Android to version 1.12.6 or newer"
            }
          ],
          "value": "Upgrade ArcSearch on Android to version 1.12.6 or newer"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Address bar spoofing risk in ArcSearch on Android",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
    "assignerShortName": "BCNY",
    "cveId": "CVE-2025-14809",
    "datePublished": "2025-12-19T16:39:29.458Z",
    "dateReserved": "2025-12-16T22:49:28.363Z",
    "dateUpdated": "2025-12-19T18:00:13.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14809 (GCVE-0-2025-14809)
Vulnerability from cvelistv5
Published
2025-12-19 16:39
Modified
2025-12-19 18:00
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CWE
  • CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Summary
ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
References
Impacted products
Vendor Product Version
The Browser Company of New York ArcSearch Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T17:23:52.793191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-19T18:00:13.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Address bar / Omnibox (address bar UI)"
          ],
          "platforms": [
            "Android"
          ],
          "product": "ArcSearch",
          "vendor": "The Browser Company of New York",
          "versions": [
            {
              "lessThan": "1.12.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-12-19T16:39:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.\u003c/p\u003e"
            }
          ],
          "value": "ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-154",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-154 Resource Location Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T16:39:29.458Z",
        "orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "shortName": "BCNY"
      },
      "references": [
        {
          "url": "https://arc.net/security/bulletins#cve-2025-14809-address-bar-spoofing-risk-navigation-trigger-uri-confusion-on-arcsearch-android"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade ArcSearch on Android to version 1.12.6 or newer"
            }
          ],
          "value": "Upgrade ArcSearch on Android to version 1.12.6 or newer"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Address bar spoofing risk in ArcSearch on Android",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
    "assignerShortName": "BCNY",
    "cveId": "CVE-2025-14809",
    "datePublished": "2025-12-19T16:39:29.458Z",
    "dateReserved": "2025-12-16T22:49:28.363Z",
    "dateUpdated": "2025-12-19T18:00:13.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14812 (GCVE-0-2025-14812)
Vulnerability from cvelistv5
Published
2025-12-19 16:38
Modified
2025-12-19 16:50
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Summary
ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.
References
Impacted products
Vendor Product Version
The Browser Company of New York ArcSearch Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14812",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T16:49:25.499181Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-19T16:50:33.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Address bar / Omnibox (address bar UI)"
          ],
          "platforms": [
            "iOS"
          ],
          "product": "ArcSearch",
          "vendor": "The Browser Company of New York",
          "versions": [
            {
              "lessThan": "1.45.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-12-19T16:39:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk."
            }
          ],
          "value": "ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-154",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-154 Resource Location Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T16:39:11.237Z",
        "orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "shortName": "BCNY"
      },
      "references": [
        {
          "url": "https://arc.net/security/bulletins#cve-2025-14812-address-bar-spoofing-risk-iframe-triggered-uri-navigation-on-arc-search-ios"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade ArcSearch on iOS to version 1.45.2 or newer."
            }
          ],
          "value": "Upgrade ArcSearch on iOS to version 1.45.2 or newer."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Address bar spoofing risk in Arc Search on iOS",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
    "assignerShortName": "BCNY",
    "cveId": "CVE-2025-14812",
    "datePublished": "2025-12-19T16:38:58.980Z",
    "dateReserved": "2025-12-16T23:26:11.126Z",
    "dateUpdated": "2025-12-19T16:50:33.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}