{"uuid": "ed3adaff-b0e9-45c3-a0e9-9d9076462d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "seen", "source": "https://t.me/hn_best_comments/23447", "content": "Re: Gaining access to anyones Arc browser without them...\n        \nI\u2019m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We\u2019ve written up some technical details and how we\u2019ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response.\n\nI'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here \u2013 everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.\n        \nha470, 10 hours ago", "creation_timestamp": "2026-07-30T00:01:47.139270Z"}