2 lines
2.7 KiB
JSON
2 lines
2.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"company.thebrowser.arc","platforms":["Android"],"product":"ArcSearch","vendor":"The BrowserCompany of New York","versions":[{"lessThan":"1.12.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thebrowser:arc_search:*:*:*:*:*:android:*:*","matchCriteriaId":"4E59F856-9B31-43D7-9969-9281627E6DEC","versionEndExcluding":"1.12.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ArcSearch for Android versions prior to 1.12.7 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content."},{"lang":"es","value":"ArcSearch para versiones de Android anteriores a la 1.12.7 podría mostrar un dominio diferente en la barra de direcciones al contenido que se mostraba, permitiendo la suplantación de la barra de direcciones después de la interacción del usuario mediante contenido web manipulado."}],"id":"CVE-2026-2378","lastModified":"2026-06-17T10:30:52.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-23T14:12:56.298860Z","version":"2.0.3"}}]},"published":"2026-03-20T22:16:27.497","references":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","tags":["Vendor Advisory"],"url":"https://arc.net/security/bulletins"}],"sourceIdentifier":"59469e6c-7ea7-446f-8e43-06aa32c115e8","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1021"}],"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary"}]}
|