CVE-2024-45489

Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however because of misconfigured Firebase ACLs, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and...

CVE-2024-45489

Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however because of misconfigured Firebase ACLs, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and...

PT-2024-6951

Name of the Vulnerable Software and Affected Versions: Arc versions prior to 2024-08-26 Description: Arc browser, before version 2024-08-26, contains a remote code execution issue within JavaScript boosts. Normally, JavaScript boosts cannot be shared; however, misconfigured Firebase Access Contro...