Google Fixes $90,000 Remote Code Execution Vulnerability
A $90,000 remote code execution vulnerability in Google was discovered through analysis of the OAuth flow, revealing flaws in session data handling and signature verification that allowed arbitrary code execution.
Discovery of the Vulnerability
Finding a $90,000 remote code execution vulnerability in Google began with mapping the OAuth flow shared by the company’s developer docs sites. The session format used by the system followed Flask’s standard three-part structure: ... However, at around 1,200 bytes, the size of the session data seemed unusually large for a CSRF token and a return URL, raising concerns about potential misuse.
The discovery process revealed that a leaked client secret was already a significant issue, highlighting the risks associated with improper handling of authentication credentials. This insight pointed to deeper vulnerabilities in the system’s security architecture, which could have allowed unauthorized access and execution of arbitrary code.
Exploitation and Verification
Exploitation of the vulnerability involved crafting a forged session with arbitrary key-value pairs, all of which were accepted by the server due to a flawed signature verification process, as noted in Lobsters. To confirm the vulnerability without risking harm to Google’s production systems, the researcher demonstrated the exploit by injecting a time.sleep(N) payload into the session data, as described in Lobsters and Lobsters. The payload was implemented using Python’s __reduce__ method, which allowed the server to execute time.sleep during unpickling. The response times observed during testing—such as time.sleep(0) taking 0.207 seconds and time.sleep(8) taking 8.283 seconds—corroborated that the server was indeed executing the sleep commands, confirming the vulnerability’s existence.
Impact and Confirmation of Exploitation
The impact of the $90,000 remote code execution vulnerability in Google was confirmed through several key observations. In one test, a valid signature with a real flow reached Google’s token exchange but failed later with an invalid_grant error on a fake authentication code, indicating a flaw in the validation process. Another test used a valid signature with a sleep payload, which caused a delay exactly matching the number chosen, confirming the ability to manipulate system behavior. These findings were validated on multiple DevSite hosts, including firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. To address the vulnerability, four changes were proposed: rotating exposed OAuth client secrets and terminating all sessions signed with them. These steps aim to mitigate the risk of exploitation by ensuring that compromised credentials are no longer valid.
Timeline and Resolution
On August 6, 2026, a remote code execution vulnerability was reported to Google, leading to a detailed resolution timeline. The report was triaged on August 7, 2026, and accepted later the same day. On August 27, 2026, the reward for the vulnerability was decided at $90,000, calculated as $75,000 for a Normal Google Applications (T2) Remote Code Execution (RCE) vulnerability, with an additional 20% for exceptional report quality. The vulnerability was fixed on October 7, 2026. Google acknowledged the efforts of the Bug Hunters team and DevSite engineers in addressing the issue. The resolution highlights the importance of secure deployment practices, such as assigning each deployment a unique high-entropy Flask SECRET_KEY from a server-side store, independent of OAuth credentials.
Technical Details of the Exploit
In the technical details of the exploit, the attacker constructs a custom session object with a forged CSRF token and injects a malicious pickle payload under a specific flow key. This allows the attacker to control the state parameter without requiring server-side validation. When the server processes the request, it verifies the signature, locates the injected flow entry, and passes the malicious bytes to pickle.loads for deserialization. The pickle module in Python is particularly vulnerable because it allows arbitrary code execution through the REDUCE opcode, which invokes a specified callable with its arguments. This exploit highlights the risks of using pickle for untrusted data deserialization and underscores the importance of secure session management and input validation in web applications.
Sources and reporting notes
Based on published source material. No independent hands-on testing is claimed.
