\n<\/p>\n
Arc creator The Browser Company has officially started a bug bounty program<\/a> to keep its growing Chromium-based browser\u2019s security in check. The company is also launching a new security bulletin to maintain \u201ctransparent and proactive communication\u201d with users and researchers on bug fixes and reports.<\/p>\n<\/div>\n These security revisions followed a devastating bug<\/a> a researcher found and reported to the company that would\u2019ve allowed bad actors to insert arbitrary code into anyone\u2019s browser just by knowing their easily findable user ID. <\/p>\n<\/div>\n The problem lived inside the Arc Boosts feature that lets you customize any website with CSS and Javascript. On top of its initial mitigations, the company says it now has disabled Boosts with Javascript by default and added a new global toggle to turn Boosts off completely in Arc version 1.61.2.<\/p>\n<\/div>\n The researcher, known as xyz3va, was initially paid a $2,000 bounty for the information. Now, with the new program in place, The Browser Company is upping it to $20,000 retroactively<\/a>. The vulnerability was patched on August 26th.<\/p>\n<\/div>\n With the new program, security researchers can submit reports and get rewards based on the bug\u2019s severity. Low severity findings that are \u201climited scope\u201d or \u201chard to exploit\u201d could land up to $500, Medium gets up to $2,500, High up to $10,000, and Critical earns the $20,000 ceiling.<\/p>\n<\/div>\n The blog post also outlined new practices to find other vulnerabilities, like development guidelines with additional code reviews, adding security-specific code audits, and hiring new staff for the security engineering team.<\/p>\n<\/div>\n