GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Embed Notice

HTML Code

Corresponding Notice

  1. Embed this notice
    Avoid the Hack! :donor: (avoidthehack@infosec.exchange)'s status on Monday, 23-Sep-2024 23:41:53 JSTAvoid the Hack! :donor:Avoid the Hack! :donor:

    Researcher reveals ‘catastrophic’ #security flaw in the Arc browser

    (CVE-2024-45489)

    The Arc Browser is a fork of #chromium with a lot of built-in features and integrations... and requires an account to use.

    Arc Browser uses Firebase to store user information for features like Arc Boosts. Arc Boosts can contain arbitrary javascript... with knowing the CreatorID, an attacker could inject code into other users' browsing sessions.

    Crazy to me because this implementation appeared to rely solely on user-provided identities (the CreatorID) without implementing any checks.

    This has been patched in the newest version of the Arc browser.

    #browsers #cybersecurity #cve

    https://www.theverge.com/2024/9/20/24249919/arc-browser-boost-firebase-vulnerability-patched

    In conversationabout 2 months ago from infosec.exchangepermalink
  • Help
  • About
  • FAQ
  • TOS
  • Privacy
  • Source
  • Version
  • Contact

GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.