Arc
Arc is a web browser with vertical tabs, separate Spaces and tools for organising websites. It’s made by The Browser Company, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from arc.net.
What it is
Arc uses Chromium, the browser engine behind Google Chrome. People use its sidebar, Spaces and folders to organise browsing. It also supports Chrome extensions.
The maker collects account details, device information and information about feature use. Optional Arc Max features send webpage text, tab details or downloaded filenames to OpenAI or Anthropic. Sidebar syncing uses end-to-end encryption.
Arc is being discontinued. New accounts closed on 22 October 2026, and the Mac app will stop working on 22 December 2026. Existing users can export their data before then. The service's terms also exclude children under 16.
Who makes it
The Browser Company is a New York browser developer that has been owned by Atlassian since October 2025. Its legal name is The Browser Company of New York Inc.. Its website is thebrowser.company.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Arc. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is company.thebrowser.Browser. Download it only from arc.net, not from an ad or a link someone sends you.
Fakes. In June 2024, criminals used Google ads and a fake Arc download site to distribute Poseidon malware to Mac users. The fake installer stole files, browser data and passwords.
What it connects to
In normal use, Arc talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
releases.arc.net | App downloads and updates |
securetoken.googleapis.com | Account authentication |
firestore.googleapis.com | Cloud storage for browser features |
o298668.ingest.sentry.io | Crash and error reports |
clientstream.launchdarkly.com | Feature settings and rollouts |
api.segment.io | Product usage statistics |
Security record
Problems with Arc or The Browser Company in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| CVE-2026-94181 allowed a malicious webpage to imitate Arc's address bar without a fullscreen warning; version 1.159.0 fixed it. | ↗ | |
| A crafted Easel link could install an old Boost with local disk write access after two clicks; the server fix was applied and the maker found no affected users. | ↗ | |
| Shared Easels could display arbitrary content under an arc.net address and impersonate another site; the server fix was applied and the maker found no affected users. | ↗ | |
| CVE-2024-45489 let an attacker assign malicious Boost code to another user's browser; it was fixed and the maker found no exploitation beyond the researcher's tests. | ↗ |
References
- Apple password-manager-resources: Arc bundle identifier github.com
- The Browser Company thebrowser.company
- Arc Terms of Use start.arc.net
- Atlassian financial filing: acquisition of The Browser Company sec.gov
- A farewell to Arc arc.net
- Arc Privacy Policy arc.net
- Arc Privacy & Security resources.arc.net
- Update Arc for Desktop resources.arc.net
- Arc for macOS: 2024–2026 Release Notes resources.arc.net
- Arc security practices and third-party services arc.net
- Web Browser telemetry: 2025 network test of Arc 1.90.1, archived archive.ph
- Arc Security Bulletin arc.net
- Malwarebytes: Poseidon Mac stealer distributed via Google ads malwarebytes.com