PT-2025-27003 · Arc · Arc

CVE-2024-52928 · Published 2025-06-26 · Updated 2025-06-26

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions: Arc versions prior to 1.26.1

Description: The issue allows websites with previously granted permissions to add new permissions when the user clicks anywhere on the website, due to a bypass problem in the site settings.

Recommendations: For versions prior to 1.26.1, update to version 1.26.1 or later to resolve the issue.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-52928

Affected Products

Arc

References · 6

• https://arc.net/security/bulletins#windows-site-settings-bypass-cve-2024-52928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52928 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52928 · Vendor Advisory
• https://t.me/cvetracker/27157 · Telegram Post
• https://thebrowser.company · Note
• https://twitter.com/CVEnew/status/1938290031291965885 · Twitter Post