Arc

Arc Boosts

Overview

Boosts are Arc's built-in site customisations. A user can restyle a site, hide parts of it, or write their own CSS and JavaScript that Arc injects every time the site loads. Code Boosts are in effect small browser extensions written by the user.

That makes Boosts relevant in two ways:

  • Usage evidence. A user only builds a Boost for a site they use often, and the Boost's match patterns name that site.
  • Tampering and persistence. A Boost runs arbitrary JavaScript on the pages it matches. An unexpected Boost on a banking, email, or SSO page should be treated like a suspicious extension: it can read page content, change what the user sees, or send data elsewhere.

File Locations

ArtifactPath
Boosts~/Library/Application Support/Arc/boosts/<boost-id>/

Each Boost is a directory laid out as an unpacked Chrome extension, with a manifest.json and the CSS and JavaScript files it injects. Arc loads these directories as unpacked extensions, so a Boost can also appear in the extension listing for a profile.

Undocumented layout

Arc does not document where or how it stores Boosts. The location above is taken from third-party Boost tooling that reads and writes this directory. Verify against the subject system, and preserve the whole directory rather than only the files you expect.

Manifest Structure

A code Boost's manifest.json follows the standard Chrome extension format:

{
  "manifest_version": 3,
  "name": "HN Dark",
  "version": "1.0",
  "description": "Boost",
  "content_scripts": [
    {
      "matches": ["https://news.ycombinator.com/*"],
      "css": ["styles.css"],
      "js": ["content.js"]
    }
  ]
}
FieldForensic meaning
nameUser-chosen Boost name
content_scripts[].matchesThe sites the Boost runs on
content_scripts[].jsJavaScript injected into those sites. Read it.
content_scripts[].cssStylesheets injected into those sites
versionVersion string from the manifest

Timestamps

Boosts carry no timestamps of their own. Use filesystem metadata:

TimestampIndicates
Directory birth timeWhen the Boost was created
File modification timesWhen the Boost's code or styles were last edited

Use a collection method that preserves original timestamps. Copying files with ordinary tools can reset them.

Analysis Notes

  • Review the injected code. Look for fetch/XMLHttpRequest to unknown hosts, reads of form fields or cookies, keystroke listeners, and obfuscated code. Treat these as you would a malicious extension.
  • Check the match patterns. Broad patterns such as <all_urls> or *://*/* on a Boost are unusual and worth explaining.
  • Correlate with history. Boost creation and edit times should line up with visits to the matched site in History.
  • Missing manifests. A Boost directory without a valid manifest.json may be half-created or tampered with. Keep and review its files anyway.

What macfor Collects

The browser.arc plugin copies every file in each Boost directory (with original timestamps) and emits one arc_boost record per directory:

FieldMeaning
boost_dirDirectory name (the Boost ID)
name, description, version, manifest_versionFrom manifest.json
matchesAll content-script match patterns
script_files, style_filesInjected JS and CSS files named in the manifest
filesEvery file found in the directory
manifest_validfalse if manifest.json is missing or malformed (the record is still emitted)
created_at, modified_atDirectory birth and modification times

References

Next
Messages Overview