CVE-2024-52928

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-26 · updated 2026-06-17
Weakness: CWE-284

Description

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.

Affected products

Thebrowser Arc: before 1.26.1 — fixed in 1.26.1

How to fix

Upgrade to a fixed version: Thebrowser Arc 1.26.1. Check the vendor advisory for mitigations.

References

https://arc.net/security/bulletins#windows-site-settings-bypass-cve-2024-52928
https://thebrowser.company

Get alerted when CVE-2024-52928 or the next vulnerability affects your stack