> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Google Fixes $90,000 Remote Code Execution Vulnerability
- URL: https://www.stirup.si/google-fixes-90-000-remote-code-execution-vulnerability-1cd7e541/
- Published: 2026-10-13T15:52:24.000Z
- Updated: 2026-10-13T15:52:24.000Z
- Description: A $90,000 remote code execution vulnerability in Google was discovered through analysis of the OAuth flow, revealing flaws in session data handling and signature verification that allowed arbitrary code execution.
- Author: Satish Das
- Tags: Community, News, Stirup Research

## Discovery of the Vulnerability

Finding a $90,000 remote code execution vulnerability in Google began with mapping the OAuth flow shared by the company’s developer docs sites. The session format used by the system followed Flask’s standard three-part structure: ... However, at around 1,200 bytes, the size of the session data seemed unusually large for a CSRF token and a return URL, raising concerns about potential misuse.

The discovery process revealed that a leaked client secret was already a significant issue, highlighting the risks associated with improper handling of authentication credentials. This insight pointed to deeper vulnerabilities in the system’s security architecture, which could have allowed unauthorized access and execution of arbitrary code.

## Exploitation and Verification

Exploitation of the vulnerability involved crafting a forged session with arbitrary key-value pairs, all of which were accepted by the server due to a flawed signature verification process, as noted in [*Lobsters*](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce?ref=stirup.si). To confirm the vulnerability without risking harm to Google’s production systems, the researcher demonstrated the exploit by injecting a `time.sleep(N)` payload into the session data, as described in [*Lobsters*](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce?ref=stirup.si) and [*Lobsters*](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce?ref=stirup.si). The payload was implemented using Python’s `__reduce__` method, which allowed the server to execute `time.sleep` during unpickling. The response times observed during testing—such as `time.sleep(0)` taking 0.207 seconds and `time.sleep(8)` taking 8.283 seconds—corroborated that the server was indeed executing the sleep commands, confirming the vulnerability’s existence.

## Impact and Confirmation of Exploitation

The impact of the $90,000 remote code execution vulnerability in Google was confirmed through several key observations. In one test, a valid signature with a real flow reached Google’s token exchange but failed later with an `invalid_grant` error on a fake authentication code, indicating a flaw in the validation process. Another test used a valid signature with a sleep payload, which caused a delay exactly matching the number chosen, confirming the ability to manipulate system behavior. These findings were validated on multiple DevSite hosts, including `firebase.google.com`, `developer.android.com`, `source.android.com`, and `docs.partner.android.com`. To address the vulnerability, four changes were proposed: rotating exposed OAuth client secrets and terminating all sessions signed with them. These steps aim to mitigate the risk of exploitation by ensuring that compromised credentials are no longer valid.

## Timeline and Resolution

On August 6, 2026, a remote code execution vulnerability was reported to Google, leading to a detailed resolution timeline. The report was triaged on August 7, 2026, and accepted later the same day. On August 27, 2026, the reward for the vulnerability was decided at $90,000, calculated as $75,000 for a Normal Google Applications (T2) Remote Code Execution (RCE) vulnerability, with an additional 20% for exceptional report quality. The vulnerability was fixed on October 7, 2026\. Google acknowledged the efforts of the Bug Hunters team and DevSite engineers in addressing the issue. The resolution highlights the importance of secure deployment practices, such as assigning each deployment a unique high-entropy Flask SECRET\_KEY from a server-side store, independent of OAuth credentials.

## Technical Details of the Exploit

In the technical details of the exploit, the attacker constructs a custom session object with a forged CSRF token and injects a malicious pickle payload under a specific flow key. This allows the attacker to control the state parameter without requiring server-side validation. When the server processes the request, it verifies the signature, locates the injected flow entry, and passes the malicious bytes to `pickle.loads` for deserialization. The `pickle` module in Python is particularly vulnerable because it allows arbitrary code execution through the `REDUCE` opcode, which invokes a specified callable with its arguments. This exploit highlights the risks of using `pickle` for untrusted data deserialization and underscores the importance of secure session management and input validation in web applications.

## Sources and reporting notes

- [Lobsters](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce?ref=stirup.si)
- [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/?ref=stirup.si)
- [infoq.com](https://www.infoq.com/news/2026/10/zimbra-command-injection/?utm%5Fcampaign=infoq%5Fcontent&utm%5Fsource=infoq&utm%5Fmedium=feed&utm%5Fterm=global)

Based on published source material. No independent hands-on testing is claimed.