CVE-2024-52928

Executive Summary

CVE-2024-52928 is a critical security vulnerability in the Arc browser for Windows, affecting versions prior to 1.26.1. The flaw allows a website that has been granted any permission (e.g., microphone, camera, location) to silently add new permissions when the user clicks anywhere on the page. This bypasses the browser's site settings permission model, enabling an attacker to escalate privileges from a single granted permission to full control over the user's system resources. The vulnerability has a CVSS score of 9.6 (Critical) and is currently unpatched in older versions. No public exploit code or Nuclei template is available, but the attack vector is straightforward and requires only user interaction (a click). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high due to the simplicity of the attack.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a client-side browser vulnerability specific to the Arc browser on Windows.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The attack is initiated remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior access.
• User Interaction: Required (UI:R) – The victim must click on the website.
• Scope: Changed (S:C) – The vulnerability impacts resources beyond the original authorization scope.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Full data modification possible.
• Availability Impact: High (A:H) – Full system compromise possible.

Threat Level: Critical. The vulnerability allows a website with a single granted permission to silently escalate to full permissions, bypassing user consent.

Deep Dive & Mechanics

The vulnerability resides in the Arc browser's permission management system on Windows. When a user grants a website a specific permission (e.g., camera access), the browser stores this permission in a site settings database. The flaw occurs when the website requests additional permissions: the browser incorrectly treats any user click on the page as implicit consent for all pending permission requests, even if those requests were not explicitly shown or approved.

Technical Flow:

1. A user visits a malicious website and grants it a low-risk permission (e.g., clipboard read).
2. The website then requests multiple high-risk permissions (e.g., camera, microphone, location) in the background.
3. When the user clicks anywhere on the page (e.g., to scroll or interact with content), the browser automatically approves all pending permission requests.
4. The attacker now has full access to the user's camera, microphone, location, and other resources.

This bypasses the intended permission model where each permission must be explicitly granted by the user. The vulnerability is specific to the Windows version of Arc; macOS and Linux versions are not affected.

Vulnerable vs. Patched Code

Vulnerable Code (Arc < 1.26.1): The permission request handler in the browser's site settings module does not properly validate the source of user interaction. It treats any click event as a valid consent signal for all pending permission requests.

// Vulnerable pseudo-code
function handlePermissionRequest(permission) {
    if (userClicked) {
        grantPermission(permission); // No check if click was for this specific permission
    }
}

Patched Code (Arc >= 1.26.1): The patched version introduces a per-permission consent flag that must be explicitly set by the user for each permission request. A generic click no longer grants all pending permissions.

// Patched pseudo-code
function handlePermissionRequest(permission) {
    if (userClicked && permission.consentFlag) {
        grantPermission(permission);
    }
}

The patch ensures that each permission request requires its own explicit user interaction, preventing silent escalation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Arc browser version < 1.26.1 on Windows.
• A website with a granted permission (e.g., clipboard read).
• User interaction (a click on the page).

Exploitation Steps:

1. Host a malicious website that requests a low-risk permission (e.g., clipboard read) and gets it granted by the victim.
2. After the permission is granted, the website silently requests multiple high-risk permissions (camera, microphone, location) using the Permissions API.
3. The website displays a benign element (e.g., a button or link) that the victim is likely to click.
4. When the victim clicks, the browser grants all pending permissions.
5. The attacker now has full access to the victim's camera, microphone, and location.

Proof-of-Concept Code:

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2024-52928 PoC</title>
</head>
<body>
    <h1>Click anywhere to grant permissions</h1>
    <script>
        // Step 1: Request a low-risk permission (clipboard-read)
        navigator.permissions.query({name: 'clipboard-read'}).then(result => {
            if (result.state === 'granted') {
                // Step 2: Request high-risk permissions
                navigator.mediaDevices.getUserMedia({video: true, audio: true});
                navigator.geolocation.getCurrentPosition(() => {});
                // Step 3: Wait for user click
                document.addEventListener('click', () => {
                    // Permissions are automatically granted due to the vulnerability
                    console.log('All permissions granted!');
                });
            }
        });
    </script>
</body>
</html>

Note: No public exploit-db code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual permission requests from websites, especially after a user click.
• Look for patterns where a website requests multiple permissions in rapid succession.
• Use browser logs to detect permission grants that occur without explicit user consent dialogs.

Defense:

• Upgrade Arc to version 1.26.1 or later.
• Implement browser policies that require explicit user consent for each permission request.
• Educate users to be cautious about granting permissions to untrusted websites.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from the browser to domains associated with the attacker.
• Process: Arc browser process (arc.exe) making unexpected system calls to access camera, microphone, or location.
• File: No specific file IOCs; the vulnerability is logic-based.
• Registry: No specific registry changes.
• Logs: Browser permission logs showing multiple permissions granted in a short time frame without user interaction dialogs.

Detection Engineering

YARA Rule

rule CVE_2024_52928_Arc_Permission_Bypass {
    meta:
        description = "Detects Arc browser versions vulnerable to CVE-2024-52928"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-52928"
    strings:
        $version_string = "Arc" ascii wide nocase
        $version_number = /1\.\d+\.\d+/ ascii wide
    condition:
        $version_string and $version_number and
        for any i in (1..#version_number): (
            uint16(version_number[i]) < 0x312E32362E31 // "1.26.1" in hex
        )
}

Sigma Rule

title: CVE-2024-52928 - Arc Browser Permission Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-52928 by monitoring for rapid permission grants in Arc browser logs.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52928
logsource:
    product: windows
    service: browser
    definition: 'Arc browser permission logs'
detection:
    selection:
        EventID: 4663
        ObjectName: '*Arc*'
        AccessMask: '0x1' # Permission grant
    condition: selection | count() by ObjectName > 5 within 60 seconds
falsepositives:
    - Legitimate websites requesting multiple permissions with user consent
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52928 - Arc Browser Permission Bypass Exploit Attempt"; flow:to_server,established; content:"|GET|"; http_method; content:"/permissions"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Arc: Update to version 1.26.1 or later on Windows. This is the only complete fix.
2. Restrict Permissions: Manually revoke all permissions for untrusted websites in Arc's site settings.
3. User Education: Warn users not to click on suspicious websites, especially after granting any permission.

Long-Term Mitigations:

• Implement browser policies that require explicit user consent for each permission request.
• Monitor for similar vulnerabilities in other Chromium-based browsers.
• Conduct regular security audits of permission management systems.

Workarounds:

• Use a different browser until the patch is applied.
• Disable all permissions by default and only enable them on a per-site basis with strict user interaction requirements.

Valters IT
Securing Digital Frontiers