CVE Program partner

BCNY

The Browser Company of New York

API
CVEs, 365 days99 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationThe Browser Company of New York
RoleCNA
TypeVendor, Bug Bounty Provider
Reports tomitre
ScopeThe Browser Company of New York branded products and technologies only.
Advisorieshttps://arc.net/security/bulletins

Latest CVEs · RSS

  • CVE-2026-94183 2026-09-23 · CVSS 7.4
    Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the back
  • CVE-2026-94181 2026-09-23 · CVSS 7.4
    An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestF
  • CVE-2026-18534 2026-08-18 · CVSS 7.4
    ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate brow
  • CVE-2026-12348 2026-06-16 · CVSS 7.4
    Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled conte
  • CVE-2026-2378 2026-03-20 · CVSS 7.4
    ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing a
  • CVE-2025-15032 2026-01-16 · CVSS 7.4
    Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and
  • CVE-2025-14809 2025-12-19 · CVSS 7.4
    ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing a
  • CVE-2025-14812 2025-12-19 · CVSS 7.5
    ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme
  • CVE-2025-13132 2025-11-21 · CVSS 7.4
    This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, user

All CVE Program partners