Illustration: Cath Virginia / The Verge
A security researcher revealed a ‘catastrophic’ vulnerability in the Arc browser that would have allowed attackers to insert arbitrary code into other users’ browser sessions with little than an easily findable user ID. The vulnerability was patched on August 26th and disclosed today in a blog post by security researcher xyz3va, as well as a statement from The Browser Company. The company says that its logs indicate no users were affected by the flaw.
The exploit, CVE-2024-45489, relied on a ...
