CVE-2024-52928

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-52938.8D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent att CVE-2024-529354.1Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's vi CVE-2024-529364.4Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's vir CVE-2024-529376.7Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's vi CVE-2024-529387.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities CVE-2024-529397.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the G CVE-2024-52946.5D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attacke CVE-2024-529407.5AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic CVE-2024-529415.4An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inje CVE-2024-529425.4An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inje CVE-2024-529435.4An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inje CVE-2024-529445.4An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inje