RESEARCHERS REVEAL CATASTROPHIC SECURITY FLAW IN THE ARC BROWSER

Summary from the TLDR InfoSec newsletter

A security researcher has discovered a vulnerability in the Arc browser that could lead to RCE on other users. The Arc browser has a feature called Boosts that allows arbitrary CSS and JavaScript to run and modify websites in users' browsers. The vulnerability arises from improper ACLs on The Browser Company's Firebase data store, which allows attackers to apply Boosts to different users' browsers by changing the user ID that they are attached to. An update has been pushed and The Browser Company has committed to improving its security posture.