CVE-2026-12348: Address Bar Spoofing in Arc Search for Android (window.open race condition)

Synopsis

Address bar spoofing in Arc Search for Android (all versions) allows a remote attacker to display a trusted domain in the address bar while the browser actually renders attacker-controlled content. The attack is reachable over the network, requires no authentication, and only needs the victim to interact with a malicious link or page triggering a window.open race condition. Successful exploitation enables convincing phishing attacks by making fraudulent pages appear to originate from a legitimate, trusted domain. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by luring them to a malicious URL or injecting content on a reachable page.

• AuthenticationNot required

  No account or credentials are required; the attacker needs only to get the victim to load attacker-controlled content.

• Victim interactionRequired

  The victim must interact with a malicious link or page that triggers the window.open race condition, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and does not depend on race-condition timing between attacker and defender, special memory layout, or other unpredictable environmental factors beyond the window.open mechanism described in the advisory.

Blast Radius

• The attacker renders fully attacker-controlled HTML, JavaScript, and form content inside the victim's browser tab while the address bar displays a trusted domain the victim recognizes.
• Victims who enter credentials, payment details, or other sensitive data on the spoofed page hand that data directly to the attacker's infrastructure.
• Because the spoofed origin appears legitimate, browser-level trust indicators (HTTPS lock, domain display) provide no warning, increasing the effective success rate of credential-harvesting campaigns.