Root cause
Cross-product identifier exposure and insufficient field-level privacy controls weakened account pseudonymity.
Demonstrated impact
Researchers reported that private email addresses associated with YouTube users could be revealed. No mass breach is established.
Lessons for review
- Treat cross-product identifiers as sensitive correlation data.
- Require entitlement before returning identity attributes.
- Verify remediation across every affected component.
Award and evidence
One report: December 3 entry explicitly says it returned for additional reward consideration. Headline rounds to $10,000. Exact arithmetic is $10,633. USD uses Google web VRP denomination documented by google-usd-context. Awarded, not confirmed paid.
Primary source reviewed; individual award and attribution checked. Historical defensive summary only. Official 2024 program announcement was read in the cloud browser for USD denomination only; its advertised maximum is not award evidence.
- Award evidence is not an independently audited cash receipt.
- The source uses dollar notation, with USD established from Google program context.
- No public report ID, recipient split, or exact fix-deployment date is provided.
- Separate from the March 2025 creator-metadata report and its USD 20,000 award.
Recorded timeline
- Published
- 2025-02-12explicit
- Public Disclosure
- 2025-02-12explicit
- Reported
- 2024-09-15explicit
- Awarded
- 2024-12-12explicit · Final additional award; initial award was November 5, 2024.
Sources and provenance
- Leaking the email of any YouTube user for $10,000 Arvin Shivram and Nathan · reviewed 2026-10-02
- Google and Alphabet VRP reward-denomination announcement, July 11, 2024 Sam Erb and Krzysztof Kotowicz / Google · reviewed 2026-10-02
Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.