Google

Escaping Google Cloud Application Integration Sandbox: Straight into Borg

by

Author: nopnop (@__nopnop) Published: August 26, 2026 Source: https://nopnop.pro/2026/08/26/escaping-google-cloud-application-integration-sandbox/ Summary Security researcher nopnop documents a sandbox-escape vulnerability, CVE-2025-0982, in Google Cloud’s Application Integration service. The service’s JavaScript task feature ran customer code on the Rhino engine (a Java-based JavaScript interpreter), and a weakness in its custom Java sandbox let the author break out and execute … Read more

Hacking Google Support: Leaking millions of customer records ($14k bounty)

by

Author: Michael Dalton Published: March 31, 2026 (reported to Google June 1, 2025) Source: https://michaeldalton.au/posts/hacking-google-support Summary Michael Dalton documents a missing-authorization flaw in Google’s Real-time Support platform (the backend behind Google’s support chat/phone widgets) that exposed large volumes of support-case data. Starting from an API key hardcoded in Google’s client-side support-widget JavaScript, the researcher reached … Read more

StubZero: $148,337 RCE in Google Cloud Production

by

Author: Arvin Shivram (brutecat) Published: May 22, 2026 Source: https://brutecat.com/articles/google-cloud-rce/ Summary Security researcher brutecat (Arvin Shivram) documents two separate vulnerability chains, three months apart, that each reached remote code execution inside Google Cloud’s production environment via the Application Integration platform. Both escalated from information disclosure and cross-tenant access to the ability to run RPCs as … Read more

Decoding Google: Converting a Black Box to a White Box

by

Author: Arvin Shivram (brutecat) Published: November 1, 2024 (with later updates in 2025) Source: https://brutecat.com/articles/decoding-google/ Summary This is a methodology writeup, not a single-vulnerability disclosure. brutecat (Arvin Shivram) documents how to turn Google’s opaque internal APIs into a “white box” for security research: locating machine-readable API discovery documents, understanding how authentication works on the web … Read more