Awesome Google VRP Writeups (@gvrp_writeups) header
Awesome Google VRP Writeups (@gvrp_writeups) profile picture

Awesome Google VRP Writeups

@gvrp_writeups

Automatically tweeting new writeups from the GitHub repository "awesome-google-vrp-writeups".

 GitHub Actions
github.com/xdavidhu/awesome-google-vrp-writeups
Joined April 2021
  • Tweets165
  • Following1
  • Followers3.3K
New Google VRP writeup "Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain" for a bounty of $250,000 by @xbow: xbow.com/labs/research/zero-…
Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain

Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain

Google awarded this chain the first $250,000 Chrome full-chain reward under the VRP rules introduced in April 2026. This post is about the exploit.

xbow.com
1
12
749
New Google VRP writeup "Breaking into Google's GFile for $100k" for a bounty of $97,604.4 by @brutecat: bughunters.google.com/blog/b…
Blog: Breaking into Google's GFile for $100k

Blog: Breaking into Google's GFile for $100k

This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.

bughunters.google.com
13
141
4,420
New Google VRP writeup "Hacking Google with A.I. for $500,000" for a bounty of $500,000 by @brutecat: brutecat.com/articles/hackin…
1
6
116
5,828
New Google VRP writeup "How I Found a $90,000 Remote Code Execution Vulnerability in Google" for a bounty of $90,000 by @soeckly: simonkoeck.com/writeups/goog…
How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

simonkoeck.com
2
15
584
New Google VRP writeup "Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking" for a bounty of $13,337 by Mohamed Benchikh: weirdmachine64.github.io/res…
Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking // weirdmac...

Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking // weirdmac...

RFC 8628's device authorization grant lets a TV or CLI

weirdmachine64.github.io
9
45
1,387
New Google VRP writeup "Android Lock Screen Bypass via Google Gemini — The Patch That Wasn’t" for a bounty of $??? by Sandiyo Christan: medium.com/@sandichrist6/and…
Android Lock Screen Bypass via Google Gemini — The Patch That Wasn’t (Status: Not Fixed)

Android Lock Screen Bypass via Google Gemini — The Patch That Wasn’t (Status: Not Fixed)

TL;DR: On a fully patched Pixel 6a running Android 16, an attacker with physical access can escape the lock screen in under 60 seconds…

infosecwriteups.com
4
15
1,302
New Google VRP writeup "StubZero: $148,337 RCE in Google Cloud Production" for a bounty of $148,337 by @brutecat: brutecat.com/articles/google…
StubZero: $148,337 RCE in Google Cloud Production

StubZero: $148,337 RCE in Google Cloud Production

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

brutecat.com
11
77
2,401
New Google VRP writeup "1-click Oauth client takeover through henhouse UI" for a bounty of $13,340 by rand0m_unk0wn: random-unknown-username.gith…
18
125
5,167
New Google VRP writeup "Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel" for a bounty of $7,000 by @weizmangal: unit42.paloaltonetworks.com/…
Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel

Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel

A high-severity CVE-2026-0628 in Chrome's Gemini allowed local file access and privacy invasion. Google quickly patched the flaw.

unit42.paloaltonetworks.com
2
21
1,432
New Google VRP writeup "Weaponizing NotebookLM: How a Harmless Intent Can Silently Brick Your System Storage" for a bounty of $0 by Sandiyo Christan: medium.com/@sandichrist6/wea…
Weaponizing NotebookLM: How a “Harmless” Intent Can Silently Brick Your System Storage

Weaponizing NotebookLM: How a “Harmless” Intent Can Silently Brick Your System Storage

Exploiting an Improper Input Validation vulnerability to cause permanent Denial of Service (DoS) through device storage exhaustion.

medium.com
1
17
1,484
New Google VRP writeup "Hacking Google Support: Leaking millions of customer records" for a bounty of $14,337 by @michaeldaltonau: michaeldalton.au/posts/hacki…
13
100
6,678
New Google VRP writeup "Remote Command Execution in Google Cloud with Single Directory Deletion" for a bounty of $??? by @ryotkak: flatt.tech/research/posts/re…
Remote Command Execution in Google Cloud with Single Directory Deletion

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google....

flatt.tech
1
13
1,052
New Google VRP writeup "LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities" for a bounty of $??? by @terminatorLM: tenable.com/blog/leakylooker…
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities

LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities

Tenable Research revealed "LeakyLooker," a set of nine novel cross-tenant vulnerabilities in Google Looker Studio. These flaws could have let attackers exfiltrate or modify data across Google...

tenable.com
3
13
899
New Google VRP writeup "LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)" for a bounty of $??? by @terminatorLM: tenable.com/blog/google-look…
LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

Tenable Research discovered two novel vulnerabilities in Google Looker that could allow an attacker to completely compromise a Looker instance. Google moved swiftly to patch these issues. Organizat...

tenable.com
2
5
714
New Google VRP writeup "GeminiJack: the google gemini zero-click vulnerability leaked gmail, calendar and docs data" for a bounty of $??? by @sasi2103: noma.security/blog/geminijac…
GeminiJack: the Google Gemini zero-click vulnerability leaked Gmail, Calendar and Docs data | Noma

GeminiJack: the Google Gemini zero-click vulnerability leaked Gmail, Calendar and Docs data | Noma

Noma Labs discovered GeminiJack, a zero-click indirect prompt injection in Google Gemini Enterprise that exfiltrated Gmail, Calendar, and Docs data.

noma.security
1
17
1,066
New Google VRP writeup "Remote Command Execution in Google Cloud with Single Directory Deletion" for a bounty of $??? by @ryotkak: flatt.tech/research/posts/re…
Remote Command Execution in Google Cloud with Single Directory Deletion

Remote Command Execution in Google Cloud with Single Directory Deletion

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google....

flatt.tech
10
68
3,967
New Google VRP writeup "LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities" for a bounty of $??? by @terminatorLM: tenable.com/blog/leakylooker…
LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities

LeakyLooker: Hacking Google Cloud’s Data via Dangerous Looker Studio Vulnerabilities

Tenable Research revealed "LeakyLooker," a set of nine novel cross-tenant vulnerabilities in Google Looker Studio. These flaws could have let attackers exfiltrate or modify data across Google...

tenable.com
2
6
746
New Google VRP writeup "LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)" for a bounty of $??? by @terminatorLM: tenable.com/blog/google-look…
LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

Tenable Research discovered two novel vulnerabilities in Google Looker that could allow an attacker to completely compromise a Looker instance. Google moved swiftly to patch these issues. Organizat...

tenable.com
2
20
1,039
New Google VRP writeup "GeminiJack: the google gemini zero-click vulnerability leaked gmail, calendar and docs data" for a bounty of $??? by @sasi2103: noma.security/blog/geminijac…
GeminiJack: the Google Gemini zero-click vulnerability leaked Gmail, Calendar and Docs data | Noma

GeminiJack: the Google Gemini zero-click vulnerability leaked Gmail, Calendar and Docs data | Noma

Noma Labs discovered GeminiJack, a zero-click indirect prompt injection in Google Gemini Enterprise that exfiltrated Gmail, Calendar, and Docs data.

noma.security
7
32
1,965
New Google VRP writeup "Privilege Escalation via a Service Account Impersonation Chain" for a bounty of $??? by @j_domeracki: jdsec.cloud/posts/2026-01-17…
Privilege Escalation via a service account impersonation chain

Privilege Escalation via a service account impersonation chain

Table of Contents Preface TLDR Live Hacking Event 101 Getting invited Picking the target Why Google SecOps SOAR? Reading the docs Methodology SOAR Integrations Python execution environment aka...

jdsec.cloud
5
27
2,139
Load more