“this is against arc’s privacy policy which clearly states arc does not know which sites you visit.”
Arc stored user Boosts, which can run arbitrary JavaScript, in Firestore and picked which ones to load by a creatorID field anyone could rewrite. Swap in a victim’s user ID and your code runs in their browser, even on chrome://settings. The Browser Company patched it in a day and paid $2,000 for a hole that owned every user. The same research found Arc phoning home with every site you visit, the exact thing its privacy policy said it never knew.