Google Bug Bounty

A security researcher has disclosed finding a remote code execution vulnerability in Google's developer site, reportedly earning a $90,000 bounty through Google's bug bounty program. According to the writeup, the flaw involved Flask session pickle deserialization, which could allow attackers to run arbitrary code on the service. The disclosure has drawn widespread attention among security professionals.

Google has updated the rules of its Open Source Software Vulnerability Reward Program so that product vulnerabilities are no longer accepted under it. Security researchers flagging flaws in Google products will now need to use the separate, product-specific vulnerability reporting channels instead of the OSS-focused program. The change is drawing attention from the security community, who are discussing how it affects where researchers should submit findings and what it signals about Google's bug bounty priorities.

An essay argues that principles drawn from peacock biology—exaggerated displays attracting unintended attention—explain the dysfunction now plaguing Google's bug bounty program. The piece suggests the reward system has drawn low-quality or excessive reports, overwhelming the program in ways its designers did not anticipate. Commentators are weighing whether incentive structures in security research can be redesigned to curb the problem.

Security researcher Simon Koeck has published a writeup describing a remote code execution vulnerability he found in Google, reportedly earning a $90,000 bounty. The flaw involves Flask session pickle deserialization on Google Devsite. The disclosure is being circulated and discussed among developers and security commentators online.

XBOW, an AI-driven security system, chained three previously unknown Chrome vulnerabilities into a full exploit that could achieve remote code execution on Windows from a web page without user interaction. The bugs were found and weaponised in six days using AI agents. Google confirmed and patched all three in Chrome 152.0.7977.82 and paid a $250,000 top-tier bounty. Security researchers are debating what the speed of AI-built exploit chains means for browser defences.

Google has paused its open-source bug bounty program, attributing the decision to a flood of low-quality, AI-generated vulnerability reports that are overwhelming reviewers. The move has sparked discussion in the security community about how automated AI submissions are straining bug bounty programs and making it harder to find genuine flaws. It also raises questions about the future of open-source security funding.