This vulnerability (CWE-451) allows an attacker to spoof the browser's address bar by leveraging a <select> element that triggers the requestFullscreen API without displaying the fullscreen notification. This UI misrepresentation can deceive users into believing they are visiting a legitimate site when they are not. The flaw affects Arc browser versions >=0 and <1.159.0. The CVSS 3.1 score is 7.4, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and no availability impact.

An attacker exploiting this vulnerability can mislead users by spoofing the browser's address bar, potentially facilitating phishing or other social engineering attacks. There is no direct confidentiality or availability impact, but the integrity of the user interface is compromised, which can lead to users trusting malicious sites.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with fullscreen prompts and untrusted sites that might exploit this behavior.