Root cause
Untrusted file selection reached privileged storage copying. Shared temporary outputs relied on obscurity, while diagnostic metadata weakened filename secrecy.
Demonstrated impact
Unauthenticated copying was possible, but demonstrated retrieval required the separately reported Firefly capability. The panel explicitly discounted difficult exploitation and additional access requirements.
Lessons for review
- Editorial lesson: isolate temporary outputs by authenticated principal and enforce access controls independent of filename secrecy.
- Editorial lesson: restrict file-source capabilities and minimize diagnostic disclosure; document dependencies before assigning standalone impact.
Award and evidence
Separate report award; headline total is not used. Payment is unverified. USD follows the linked official denomination context. No component is counted separately.
Read both primary pages in the cloud browser after search returned no article body. Matched exact report labels to separate timeline awards. No target testing.
- Researcher narrative is hosted by Google and authored by a researcher who subsequently joined Google; conservatively classified as researcher-reported panel correspondence, without independent payment evidence.
- Resolution is stated, but deployment date and patch implementation are unspecified.
- The dollar denomination is inferred from Google’s July 2024 USD program announcement, approximately two years before the awards; it does not prove individual settlement.
- Mamba is a separately reported and separately awarded finding; its retrieval demonstration depends on Firefly. The combined demonstration is not an additional record or award.
Recorded timeline
- Published
- 2026-09-11explicit
- Reported
- 2026-07-18explicit
- Awarded
- 2026-07-24explicit
Sources and provenance
- Breaking into Google's GFile for $100k Arvin Shivram (Brutecat), published on Google Bug Hunters · reviewed 2026-10-03
- Increasing Google & Alphabet VRP rewards up to $151,515 Sam Erb and Krzysztof Kotowicz, Google · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.