The vulnerability identified as CVE-2026-12348 in Arc Search for Android is classified under CWE-1021, which relates to improper restriction of rendered UI layers or frames. This flaw allows a remote attacker to spoof the address bar, causing it to display a trusted domain name while rendering content controlled by the attacker. This discrepancy between the displayed URL and the actual content can be exploited for phishing attacks. The CVSS 3.1 base score is 7.4, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability enables attackers to perform phishing attacks by misleading users into believing they are visiting a trusted domain while actually viewing attacker-controlled content. This can lead to credential theft or other malicious actions relying on user trust. The integrity of the browsing session is compromised, but confidentiality and availability are not directly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with links or content in Arc Search for Android and verify URLs carefully. No official remediation or temporary fixes have been published by the vendor at this time.