ArcSearch for iOS versions before 1.48.0 contain a CWE-1021 vulnerability where the browser improperly restricts rendered UI layers or frames. Specifically, the address bar can remain hidden after a page-initiated scroll, which allows malicious web content to imitate browser UI elements. This spoofing risk can mislead users about the authenticity of the displayed content. The CVSS 3.1 base score is 7.4, reflecting a high impact on integrity with no confidentiality or availability impact. The vulnerability requires user interaction (UI:R) and can be exploited remotely without privileges (AV:N/PR:N). No official patch or remediation level has been published yet by the vendor.

The vulnerability allows attacker-controlled content to impersonate browser interface elements by keeping the address bar hidden after scrolling, increasing the risk of spoofing attacks. This can lead to users being deceived about the legitimacy of the web page they are viewing, potentially facilitating phishing or other social engineering attacks. There is no direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with web content in affected versions of ArcSearch for iOS. Avoid visiting untrusted websites or clicking suspicious links that could exploit this UI spoofing vulnerability.