How a simple mistake left Arc Browser wide open to hackers

A major exploit was discovered in the Arc browser recently that allowed an attacker to remotely execute JavaScript on any website. Learn how this vulnerability was caused by a simple Firebase misconfiguration.

#programming #hack #thecodereport

💬 Chat with Me on Discord

🔗 Resources

🔥 Get More Content - Upgrade to PRO

Use code YT25 for 25% off PRO access

🎨 My Editor Settings

- Atom One Dark
- vscode-icons
- Fira Code Font

🔖 Topics Covered

Firebase Arc Browser Exploit explained
Pitfalls of using Firebase
Arc browser vs Chrome
Browser exploits in 2024
How to hack Arc browser
Firebase rules fails

[mathieu]

I was terrified about this vulnerability because I thought someone was going to use it to push their new JavaScript framework onto my computer.

[hi.im.vijayy]

3:41 ayy made it into a fireship video

[AQDuck]

* Proprietary browser made by a for-profit startup
* Requires an account to use
* Pinky-promises absolute privacy yet gives the browser away for free and expect to be profitable
* Already had a vulnerability worthy of a 9.8 CVSS
* Valued the bounty for said 9.8 CVE a measly $2000


Yeah, I'm staying as far away from that as possible...

[suplays]

YES!! First exploit I can actually understand 🎉🎉🎉

[sadfacekira]

luckily i was safe from this exploit by using arc on windows where 95% of the features from the macOS version are literally not implemented 👍

[weird_autumn]

regardless of any security issues, i still don't trust a VC-backed browser

[jordank]

"I use Arc, by the way."

Really, that aged well.

[KETHERCORTEX]

Arc FAQ: "Rest assured that your data and security is of utmost importance to us".
Real life: "Databases hard, access control not understand".

[samranda]

xyzeva had a good quote in her article that was like “firestore is a database-as-a-backend service that allows for developers to not care about writing a backend”

[addanametocontinue]

Imagine using Google Maps to visit the near McD's and you end up getting diddled by Diddy.

[HiImKyle]

Shouldn't have to have an account to use a browser in the first place. Huge red flag. But w/e

[edwinanciani]

the way to sneak Diddy in the video was really great

[qawmkl]

3:00 intercepting gmaps and redirecting you to diddy's mansion is just pure evil LMAO

[TRDiscordian]

When I first heard of Arc I said "if it's not open-source, or doesn't have very public audits, not interested", I got a lot of hate. Now here we (predictably) are lol.

[jmonify]

whenever I hear someone or company is using Firebase, soon after, I hear there is an exploit on their apps because the developers simply didn't know what they are doing. I wonder how many other multimillion dollar apps were developers that don't know what they are doing

[MRPtech]

00:12 so many memories. This was in my primary school. Seeing this poster in Head Teachers office.

[Metruzanca]

I really wish the firebase rules were reversed. Everything locked down by default and you have to explicitly allow read/write for things. Would make life so much easier.

[covle]

If you need to create an account for something that's private and secure, it's not private and secure.

[damonguzman]

Eva is an absolute legend at this point. She’s exposed security flaws in over 100, 000 websites using Firebase and now even Arc Browser. Holy!!

[phead]

And people were mocking me for not wanting to use browser with forced login.