The Browser Company of New York vulnerabilities
We track 8 vulnerabilities in The Browser Company of New York products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest The Browser Company of New York vulnerabilities
- 7.4 High severity
Arc Search: User Interface (UI) Misrepresentation of Critical Information
Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI element
- 7.4 High severity
Arc: User Interface (UI) Misrepresentation of Critical Information
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.
- 7.4 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
- 7.4 High severity
Arc Search: Improper Restriction of Rendered UI Layers or Frames
Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.
- 7.4 High severity
Dia: Improper Restriction of Rendered UI Layers or Frames
Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.
- 7.5 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.
- 7.4 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
- 7.4 High severity
Dia: Improper Restriction of Rendered UI Layers or Frames
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (li