This development comes in response to a critical remote code execution flaw, tracked as CVE-2024-45489, that could have enabled threat actors to launch mass-scale attacks against users of the program. The Browser Company says new coding guidelines with an elevated focus on auditing and reviewing are now crafted, its incident response process is being revamped for better effectiveness, and new security team members will be welcomed aboard soon. A researcher found what they describe as a "catastrophic" flaw in the "Boosts" (user-created customizations) feature that allows users to use JavaScript to modify a website when it is visited. Regarding CVE-2024-45489, the Arc team notes in its latest announcement that auto-syncing of Boosts with JavaScript has been disabled, and a toggle to turn off all Boost-related features has been added on Arc 1.61.2, the latest version released on September 26. The researcher found that they could cause malicious JavaScript code to run in other users' browsers simply by changing a Boosts' creator ID to another person's ID. The Browser Company has introduced an Arc Bug Bounty Program to encourage security researchers to report vulnerabilities to the project and receive rewards. Although the flaw was present on the browser for quite a while, it was promptly addressed on August 26, 2024, a day after the researcher responsibly disclosed it to the Arc team, for which they were awarded $2,000. The flaw allowed attackers to exploit how Arc uses Firebase for authentication and database management to execute arbitrary code on a target's browser. The bug bounty program announced by the Browser Company covers Arc on macOS and Windows and Arc Search on the iOS platform. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. When that Arc Browser user visited the site, it would launch the malicious code created by an attacker. Threat actors even used the browser's popularity to push malware to Windows users. Launched a little over a year ago, Arc quickly gained popularity thanks to its innovative user interface design, customization options, uBlock Origin integration, and speedy performance.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Oct 2024 22:36:12 +0000