Arc Browser RCE Vulnerability (CVE-2024-45489)

No, but uBO also requires this permission.

Yes, but not uBO Lite.

I see

That’s strange. I only experienced this one or two times on Arch+KDE.

Any blockers, including uBOL, needs “invasive permissions” to block more complicated ads and trackers. Non-permission mode, aka, “Basic” mode is as it says: blocks basic things.

1 Like

Arc is establishing a bug bounty program, is “bolstering” their security team, has hired a new security engineer, and has “verified that no one outside of the security researcher who discovered the bug has exploited it.”

1 Like

To be fair to Arc here, they at least seem to be attempting to do something about it, and seemed to fix the vuln pretty quick. Not that I would recommend this browser. But nontheless…

1 Like

Translation: they probably have 2 security engineers now. Max.

3 Likes

Some better news, her bounty is increased to 20k.

1 Like

That is a lot better.

It’s not just shiny UI. They provide a completely different feature set. Most useful for me are split view and “web panels” which quickly opens a mobile version of a site in the browser sidebar.

I am not an expert, but I don’t think these vulnerabilities apply to Floorp as it doesn’t add any cloud-based features. As long as it pushes firefox security patches in a timely manner then that covers vulnerabilities that would actually be exploited in the wild because they target a large install base.