GAINING ACCESS TO ANYONE'S BROWSER WITHOUT THEM EVEN VISITING A WEBSITE

Summary from the TLDR Web Dev newsletter

A vulnerability in Arc Browser's use of Firebase allowed unauthorized access to any user's browser without them visiting a website. This was possible because Arc's cloud features, like Boosts, stored data in Firestore with insecure security rules. An attacker could exploit this by obtaining a user's ID, creating a malicious Boost, and changing the Boost's creator ID to the victim's. This has since been addressed by Arc, who patched the vulnerability, added a feature to disable Boosts, and started a bug bounty program.