CVE-2024-45489

Name of the Vulnerable Software and Affected Versions Arc versions prior to 2024-08-26

Description Remote code execution is possible in JavaScript boosts due to misconfigured Firebase Access Control Lists (ACLs). This flaw allows an attacker to create or update a boost using another user's ID, which forces the installation of the boost in the victim's browser. Consequently, arbitrary JavaScript can be executed within a privileged context on the victim's browser without requiring user interaction. This is identified as a cloud-based issue that did not affect any users.

Recommendations Update Arc to a version released on or after 2024-08-26.