I Found a $90k Remote Code Execution Vulnerability in Google

This title could be clearer and more informative. Try out Clickbait Shield for free (5 uses left this month).

A bug bounty writeup details how a Flask session cookie on developers.google.com leaked its own signing secret (a Google OAuth client_secret stored inside the session payload), allowing cookie forgery and ultimately unauthenticated remote code execution via pickle deserialization in the OAuth callback flow. The same vulnerable key signed sessions across seven Google domains including firebase.google.com and developer.android.com. The finding was verified using time.sleep() as a side-channel proof, reported through Google's bug bounty program, and paid $90,000 (S0 RCE, base $75,000 x1.2 for report quality). Fix involved rotating secrets, using independent high-entropy session keys, keeping OAuth flow state server-side, and dropping pickle for client-facing data.

Technical praise for the vulnerability itself is overshadowed by a long, heated argument whether the write-up was authored by an LLM (Claude), alongside a tangential debate the economics and future of bug bounties.

Questions this post answers

If the Flask SECRET_KEY used to sign session cookies is derivable from data stored inside the session itself, an attacker can recompute the signature and forge arbitrary session content. On developers.google.com, the session carried a pickled OAuth2WebServerFlow object containing the client_secret, which was also the Flask signing key, so a forged session could inject attacker-controlled pickle data into the server's pickle.loads call, achieving unauthenticated code execution. daily.dev surfaces writeups like this for developers hardening Flask session handling against deserialization attacks.

Pickle's REDUCE opcode names a callable and its arguments, and unpickling executes that call directly, so deserializing attacker-controlled pickle data is equivalent to unauthenticated remote code execution once an attacker can produce a validly signed cookie. The recommended fix is dropping pickle for anything crossing a client boundary in favor of a schema-checked, data-only format, and keeping sensitive objects server-side with only an opaque reference in the cookie. developers weighing serialization formats for session or cookie data can track this kind of risk via daily.dev.

Google paid $90,000 for a Server-Side (S0) remote code execution finding in a Normal Google Application (T2), calculated as a $75,000 base reward multiplied by 1.2 for exceptional report quality. The vulnerability affected the shared DevSite platform, with a single leaked signing key valid across seven Google domains including firebase.google.com, developer.android.com, and source.android.com. security researchers benchmarking bounty payouts for RCE findings can follow similar disclosures on daily.dev.