Description

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-18T15:16:49.667Z",
  "pubdate": "2026-08-18T15:16:49.667Z",
  "executiveSummary": "ArcSearch for iOS versions prior to 1.48.0 suffer from a User Interface (UI) spoofing vulnerability stemming from improper handling of the address bar visibility state during page-initiated scroll events.\nThe vulnerability allows an attacker-controlled web page to manipulate the browser viewport and maintain a hidden address bar state after automated scrolling occurs.\nThis behavior enables malicious content to seamlessly imitate legitimate browser interface elements, significantly increasing the risk of browser-in-the-browser attacks and sophisticated phishing campaigns.\nThe primary impact involves user deception, where victims may interact with malicious elements believing they are interacting with genuine browser chrome or trusted application UI.\nExploitation requires the victim to navigate to a malicious web page hosted on the internet, granting the attacker-controlled content the capability to execute the interface manipulation script.\nNo specific authentication or advanced privileges are required by the threat actor beyond the ability to serve arbitrary HTML and JavaScript content to the affected mobile browser instance.\nRisk implications remain high for users running unpatched versions of the application, as visual indicators of origin, such as the genuine URL bar and security badges, are effectively obscured from the user's field of view.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate state management of the browser chrome components, specifically the address bar, within ArcSearch for iOS prior to version 1.48.0.\nDuring standard browsing operations, mobile browsers dynamically hide the address bar on user-initiated scroll-down actions to maximize screen real estate for content rendering, and reveal it upon scroll-up.\nHowever, the affected component fails to correctly validate or reset the address bar visibility flags when scroll events are triggered programmatically via page-initiated scripts rather than direct user gestures.\nAn attacker exploits this flaw by embedding malicious JavaScript within a web page that forces continuous or state-locked page-initiated scrolling, effectively preventing the application from restoring the browser chrome.\nOnce the address bar is persistently hidden, the malicious content utilizes cascading style sheets (CSS) and Document Object Model (DOM) manipulation to render a meticulously crafted counterfeit browser interface at the top of the viewport.\nThis fabricated UI mimics legitimate browser elements, including fake URL indicators, SSL lock icons, and navigation controls, creating a deceptive visual context for the user.\nBecause the network exposure is standard web browsing, any external site loaded within the vulnerable browser instance can instantiate the attack vector.\nAuthentication and privilege requirements are trivial; the attacker operates entirely within the unprivileged context of the web rendering engine, requiring only that the victim accesses the crafted URL.\nThe post-exploitation impact includes advanced phishing, credential harvesting, and social engineering attacks, as the user is unable to reliably verify the actual origin or Uniform Resource Locator of the currently displayed web resource due to the obscured browser chrome."
}