Arc Search for Android versions prior to 1.12.10 do not show a fullscreen notification when a page enters fullscreen mode while the app runs in the background. This allows a remote attacker to craft websites that render fake UI elements, such as spoofed address bars, potentially misleading users about the content's origin and increasing phishing risk.