Researcher discovers Arc browser vulnerability that allowed hackers to access your browser

The security exploit was shared with Arc browser developers, who were quick to patch it.

Arc browser was launched on Windows earlier this year. (Image Source: The Browser Company)

Arc Browser, the popular Google Chrome competitor developed by The Browser Company had a “catastrophic” security flaw that might have allowed hackers access to your browser.

According to a recent blog post shared by the CEO and Cofounder of The Browser Company, the security vulnerability existed in Arc before August 25 and was fixed a day later.

Spotted by a security researcher who goes by the name “xyzeva”, the exploit lies within Arc Boosts, which allows users to run any “custom CSS and Javascript” on all websites. While these scripts cannot be shared with members, the developers synced them to Arc servers.

Story continues below this ad

On further digging, the researcher discovered that they could change anyone’s User ID to anything they liked. So when the victim used Arc the next time, it allowed the security researcher to “gain access to anyone’s browser without them even visiting a website.”

Also Read | Qualcomm approached Intel about a takeover in recent days

However, if you are using Arc, there’s no need to worry as the researcher has already shared the issue with The Browser Company, who was quick to fix the vulnerability. The developers also said that no users were affected by the exploit and that they are working to expand their manpower to fix such bugs and has migrated from Firebase for new products and features to avoid such issues.

Earlier this year, the Arc Search app on iPhone added a new feature called “Call Arc” that lets you ask questions on a phone call.