OK, so ARP spoofing is when an attacker sends out fake ARP responses associating someone else's IP address with his own mac address, thereby receiving packets meant for someone else..

My question is: who exactly can the attacker spoof? ie, what is the "domain of vulnerability" for an ARP spoofing attack?

I figured that the attacker could impersonate anyone on the same subnet/behind the same router, because ARP requests are broadcasts; but I've also read that ARP spoofers can only mimic someone on the same segment/behind the same ethernet switch... which is correct? am I missing something?

When switches are involved, segments aren't shared (unless you connect a hub to a switch), so
it doesn't make sense to "mimic someone on the same segment". Also, switches forward broadcasts
(assuming a single VLAN), so potentially the entire subnet is vulnerable to arp spoofing.