Google

Author: Michael Dalton Published: March 31, 2026 (reported to Google June 1, 2025) Source: https://michaeldalton.au/posts/hacking-google-support Summary Michael Dalton documents a missing-authorization flaw in Google’s Real-time Support platform (the backend behind Google’s support chat/phone widgets) that exposed large volumes of support-case data. Starting from an API key hardcoded in Google’s client-side support-widget JavaScript, the researcher reached … Read more

Author: Arvin Shivram (brutecat) Published: May 22, 2026 Source: https://brutecat.com/articles/google-cloud-rce/ Summary Security researcher brutecat (Arvin Shivram) documents two separate vulnerability chains, three months apart, that each reached remote code execution inside Google Cloud’s production environment via the Application Integration platform. Both escalated from information disclosure and cross-tenant access to the ability to run RPCs as … Read more

Author: Arvin Shivram (brutecat) Published: November 1, 2024 (with later updates in 2025) Source: https://brutecat.com/articles/decoding-google/ Summary This is a methodology writeup, not a single-vulnerability disclosure. brutecat (Arvin Shivram) documents how to turn Google’s opaque internal APIs into a “white box” for security research: locating machine-readable API discovery documents, understanding how authentication works on the web … Read more