The certificates are technically sound but did not match the policy GoDaddy published for its Starfield and GoDaddy hierarchies. Industry rules allowed five days; by 19 October 227,422 had been revoked.
Arc browser stops working on 22 December; new accounts closed now
EditorialBy TrustList Editorial
The Browser Company is retiring Arc to focus its security work on Dia. AI features on mobile go on 23 November, and Arc accounts are deactivated at the end with personal data deleted within 30 days.
About Arc browser stops working on 22 December; new accounts closed now
Arc browser stops working on 22 December; new accounts closed now
22 October 2026: The Browser Company is shutting down Arc, the browser it launched as a rethink of tabs and workspaces, and says Arc for macOS and Windows will stop working on 22 December 2026, when accounts are deactivated and personal data deleted within 30 days. New Arc accounts could no longer be created from 22 October, and existing users are being moved to Dia, the company's newer browser.
Not yet independently verified. The farewell page is not dated; the timeline it gives starts on 22 October, which we have used as the announcement date. We will update this when it can be confirmed, and remove this note.
Three dates to plan around
- 22 October: no new Arc accounts. The latest Arc release adds an option to export all data and a smoother import into Dia.
- 23 November: on iOS and Android, Browse for Me and the other AI features are switched off. Arc Search keeps working as a browser, but sign-in and tab sync stop.
- 22 December: Arc on macOS and Windows stops working, accounts are deactivated with personal data deleted within 30 days, and Arc Search for Android is removed from Google Play.
Until 22 December Arc keeps working as usual and receives basic updates.
Security is the stated reason
The company says keeping a browser secure "takes constant, dedicated work that is only increasing in the age of AI", and that Dia was built from the start to meet today's security standards, so its engineering and security teams will now work only on Dia. A browser that receives only basic updates for two months and then none is a risk on any managed device, which is the practical point for IT teams: Arc should be off company machines before the last update, not after.
Moving teams off Arc
Dia imports passwords, history, bookmarks, extensions, tabs and Arc's Spaces, which become Profiles, and Folders, which become Tab Groups, on both macOS and Windows; the company says the browser features are free in Dia and its AI is optional. Teams that do not want an AI browser can export Spaces and tabs as a list of links from Arc's advanced settings and import them elsewhere, but saved passwords should be moved into the company password manager rather than into another browser's store.
For organisations that allowed Arc as a personal choice, the first job is finding it: device management inventories, endpoint software lists and single sign-on logs will show who still uses it, and those users need the export done before 22 December, when their data starts to be deleted.
Company profile on TrustList: The Browser Company
Related on TrustList:
Sources
- The Browser Company: A farewell to Arc (read 2026-10-22), 22 October 2026
Categories & features
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
A Paris court ordered the Swiss non-profit resolver to block sports piracy domains for beIN, cutting the penalty to €1,000 a day. Quad9 says it cannot block by country and will stop serving users in France.
Brand names account for 333 of the applications, and the window to switch to a replacement string closes on 21 October, four weeks before the final list.
Seven are rated high, including an account takeover through OAuth2 auto-linking and fork workflows that receive repository secrets. Every release up to 28.2.0 is affected; there is no backport line.
A server provider hosting its Armenia CDN node reported unauthorised access. Managed certificates are being replaced by 31 October; customers who upload their own certificates are told to revoke and reissue them.
SA-CONTRIB-2026-254 rates CVE-2026-118539 highly critical (21 of 25): no login needed, every configuration exposed and attacks already under way. The security team tells shops to audit their orders.
Google moved Stable and Extended Stable to 156.0.8078.79/.80 with 21 security fixes. One external researcher reported four of them, including the critical one; Google states no exploitation.
The expedited releases distrust the compromised eMudhra intermediates inside the ssl module, so pip is safe even before it is updated. A tarfile filter bypass and a cookie parsing bug are fixed too.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.