arc vulnerabilities

1 known vulnerability in arc from The Browser Company. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  arc: Improper Access Control

  CVE-2024-45489Sep 20, 2024The Browser CompanyEPSS 1.24%

  Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigured Firebase ACLs), it is possible to create or update a boost using another user's ID. This installs