ArcSearch for Android versions earlier than 1.12.7 can show a domain in the address bar that does not match the visible content after a user interacts with crafted web pages. This inconsistency allows an attacker to trick users into believing they are browsing a trusted site while the loaded page is actually from a malicious source, facilitating credential theft or other phishing attacks.

The vulnerability impacts the BrowserCompany of New York’s ArcSearch application on Android devices running versions before 1.12.7. Any user with an older installation is susceptible until the application is updated to the patched release.

With a CVSS score of 7.4 the vulnerability is considered high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The description suggests that the attack is client‑side and does not involve privileged access; the attacker must deliver crafted web content that the user then interacts with in ArcSearch, making the vulnerability potentially exploitable through typical social engineering or malicious websites.