corpus.blog
41554 blogs · [ { "id": "01a0d897-ec50-72fc-8b5e-db71cca4b153", "title": "Google's PageBreak Project – Real-World Findings", "url": "https://bughunters.google.com/blog/pagebreak-real-world-findings", "published_at": "2026-09-24T00:00:00+00:00" }, { "id": "01a0b5c6-bd09-73b5-b676-3886843d440b", "title": "ESCAL8 2026: Agentic Hacking in the Lion City", "url": "https://bughunters.google.com/blog/escal8-2026-agentic-hacking-in-the-lion-city", "published_at": "2026-09-18T00:00:00+00:00" }, { "id": "01a0b5c6-bd09-73b5-b676-3886844095a1", "title": "Breaking into Google's GFile for $100k", "url": "https://bughunters.google.com/blog/breaking-into-googles-gfile-for-100k", "published_at": "2026-09-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ff83bccd8", "title": "Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust", "url": "https://bughunters.google.com/blog/scaling-memory-safety", "published_at": "2026-08-24T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ff8623586", "title": "More Cryptanalysis Makes Us All Safer", "url": "https://bughunters.google.com/blog/more-cryptanalysis-makes-us-all-safer", "published_at": "2026-08-10T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ff8f4ff02", "title": "Bug Hunting on Gemini Spark", "url": "https://bughunters.google.com/blog/spark-release", "published_at": "2026-06-05T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ff95d9cd7", "title": "Bit Rot Doesn't Always Increase Entropy – A Story from the Archives", "url": "https://bughunters.google.com/blog/bit-rot-doesnt-always-increase-entropy", "published_at": "2026-06-04T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ff9ff7e17", "title": "Where to Go Next with Quantum-Safe Certificates", "url": "https://bughunters.google.com/blog/next-with-quantum-safe-certificates", "published_at": "2026-06-01T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffa795df6", "title": "A Look at Hardware Security Keys for Passkeys", "url": "https://bughunters.google.com/blog/hardware-security-keys-for-passkeys", "published_at": "2026-05-27T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffb006284", "title": "bugSWAT in Seoul – April 2026", "url": "https://bughunters.google.com/blog/bugswat-in-seoul-april-2026", "published_at": "2026-05-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffb492362", "title": "Evolving the Android & Chrome VRPs for the AI Era", "url": "https://bughunters.google.com/blog/evolving-the-android-chrome-vrps-for-the-ai-era", "published_at": "2026-04-30T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffbee6d33", "title": "Standardizing Rewards in Google VRP: Introducing Information Tiers and Action Criticality", "url": "https://bughunters.google.com/blog/standardizing-rewards-in-google-vrp", "published_at": "2026-04-08T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffc5ba47b", "title": "Passkeys are Your New Best Friend", "url": "https://bughunters.google.com/blog/passkeys-are-your-new-best-friend", "published_at": "2026-03-30T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffd25989b", "title": "Streamlining Google’s OSS VRP: Key Rule Updates", "url": "https://bughunters.google.com/blog/ossvrp-rule-updates-2026", "published_at": "2026-03-19T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffd4f143c", "title": "Google VRPs in Review – 2025", "url": "https://bughunters.google.com/blog/google-vrps-in-review-2025", "published_at": "2026-03-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffe154a3b", "title": "Mitigating URL-based Exfiltration in Gemini", "url": "https://bughunters.google.com/blog/mitigating-url-based-exfiltration-in-gemini", "published_at": "2026-03-09T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00ffe280789", "title": "Hybrid Transport Goes Offline!", "url": "https://bughunters.google.com/blog/hybrid-transport-goes-offline", "published_at": "2026-03-04T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00fff0fd3bb", "title": "Hybrid Protocol: The JSON Upgrade", "url": "https://bughunters.google.com/blog/hybrid-protocol-the-JSON-upgrade", "published_at": "2026-02-23T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e00fffe308c6", "title": "Strengthening the Foundation: A Joint Security Review of Intel TDX 1.5", "url": "https://bughunters.google.com/blog/a-joint-security-review-of-intel-tdx-15", "published_at": "2026-02-10T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010008bf2c9", "title": "A Beginners Guide: Cross-Device Passkeys", "url": "https://bughunters.google.com/blog/passkeys", "published_at": "2026-02-03T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100090c37e", "title": "The Evolution of FIDO Experiences on Android", "url": "https://bughunters.google.com/blog/fido", "published_at": "2026-01-27T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100147ad09", "title": "Task Injection – Exploiting agency of autonomous AI agents", "url": "https://bughunters.google.com/blog/task-injection-exploiting-agency-of-autonomous-ai-agents", "published_at": "2025-12-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010021b07c4", "title": "Google's Commitment to a Quantum-Safe Future: Why PQC is Google's Path forward and not QKD", "url": "https://bughunters.google.com/blog/googles-commitment-to-a-quantum-safe-future-why-pqc-is-googles-path-forward-and-not-qkd", "published_at": "2025-12-01T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01002de6d80", "title": "Effortless Web Security: Secure by Design in the Wild", "url": "https://bughunters.google.com/blog/effortless-web-security-secure-by-design-in-the-wild", "published_at": "2025-11-14T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01003c99c30", "title": "ESCAL8 2025: Gathering Cybersecurity Expertise in Mexico City", "url": "https://bughunters.google.com/blog/escal8-2025-gathering-cybersecurity-expertise-in-mexico-city", "published_at": "2025-11-07T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01003ebee19", "title": "Announcing Google’s New AI Vulnerability Reward Program!", "url": "https://bughunters.google.com/blog/announcing-googles-new-ai-vulnerability-reward-program", "published_at": "2025-10-06T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01004559e93", "title": "Google Cloud VRP: Enhancing Transparency and Impact in Our Rewards Program", "url": "https://bughunters.google.com/blog/google-cloud-vrp-enhancing-transparency-and-impact-in-our-rewards-program", "published_at": "2025-09-25T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01004b4a427", "title": "Level Up Your Reports: Introducing Our Updated Report Quality Framework", "url": "https://bughunters.google.com/blog/level-up-your-reports-introducing-our-updated-report-quality-framework", "published_at": "2025-09-22T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100516d93d", "title": "Project Rain:L1TF", "url": "https://bughunters.google.com/blog/project-rainl1tf", "published_at": "2025-09-19T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01005953fda", "title": "Beyond Sandbox Domains: Rendering Untrusted Web Content with SafeContentFrame", "url": "https://bughunters.google.com/blog/beyond-sandbox-domains-rendering-untrusted-web-content-with-safecontentframe", "published_at": "2025-09-18T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01005c9e9d9", "title": "ESCAL8 de Google: ¡Hacking, Héroes y Horizontes en la Ciudad de México! (ESCAL8 is coming to Mexico!)", "url": "https://bughunters.google.com/blog/escal8-de-google-hacking-héroes-y-horizontes-en-la-ciudad-de-méxico-escal8-is-coming-to-mexico", "published_at": "2025-09-17T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010066c69a8", "title": "Hardening Google Cloud: Insights from the latest Cloud VRP bugSWAT", "url": "https://bughunters.google.com/blog/hardening-google-cloud-insights-from-the-latest-cloud-vrp-bugswat", "published_at": "2025-09-10T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010076af9ad", "title": "A Fuzzy Escape - A tale of vulnerability research on hypervisors", "url": "https://bughunters.google.com/blog/a-fuzzy-escape-a-tale-of-vulnerability-research-on-hypervisors", "published_at": "2025-08-18T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01007fa4117", "title": "Exploiting Retbleed in the real world", "url": "https://bughunters.google.com/blog/exploiting-retbleed-in-the-real-world", "published_at": "2025-08-07T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01008da7865", "title": "New Patch Rewards Program for OSV-SCALIBR", "url": "https://bughunters.google.com/blog/new-patch-rewards-program-for-osv-scalibr", "published_at": "2025-08-07T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01009cb0181", "title": "Escaping '' in attributes – how it helps protect against mutation XSS", "url": "https://bughunters.google.com/blog/escaping-and-in-attributes-how-it-helps-protect-against-mutation-xss", "published_at": "2025-06-12T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100a729ba5", "title": "AI bugSWAT in Tokyo & 2025 Hacker Roadshow", "url": "https://bughunters.google.com/blog/ai-bugswat-in-tokyo-2025-hacker-roadshow", "published_at": "2025-06-03T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100b41ab9a", "title": "Android VRP Announces AutoRepro – $1,000 bonus for eligible submissions!", "url": "https://bughunters.google.com/blog/android-vrp-announces-autorepro-1000-bonus-for-eligible-submissions", "published_at": "2025-03-26T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100c0f9b89", "title": "Google VRPs in Review – 2024", "url": "https://bughunters.google.com/blog/google-vrps-in-review-2024", "published_at": "2025-03-17T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100cf6ee72", "title": "Zen and the Art of Microcode Hacking", "url": "https://bughunters.google.com/blog/zen-and-the-art-of-microcode-hacking", "published_at": "2025-03-05T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100d11ed1d", "title": "A Deep Dive into JS Trusted Types Violations", "url": "https://bughunters.google.com/blog/a-deep-dive-into-js-trusted-types-violations", "published_at": "2025-02-27T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100d287e82", "title": "Secure by Design: Google's Blueprint for a High-Assurance Web Framework", "url": "https://bughunters.google.com/blog/secure-by-design-googles-blueprint-for-a-high-assurance-web-framework", "published_at": "2025-02-04T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100d7ba348", "title": "Level Up Your Open Source Karma (And Your Wallet) by Improving Security", "url": "https://bughunters.google.com/blog/level-up-your-open-source-karma-and-your-wallet-by-improving-security", "published_at": "2025-01-21T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100e27117e", "title": "Capturing the Flags of the Internet: Find 0-days in OSS and write scanners to detect them", "url": "https://bughunters.google.com/blog/capturing-the-flags-of-the-internet-find-0-days-in-oss-and-write-scanners-to-detect-them", "published_at": "2025-01-08T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100ef4a09c", "title": "Celebrating One Year of AI Bug Bounties at Alphabet", "url": "https://bughunters.google.com/blog/celebrating-one-year-of-ai-bug-bounties-at-alphabet", "published_at": "2024-12-17T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100f0ac6f2", "title": "The Great Google Password Heist: 15 years of hacking passwords to test our security (and build team culture!)", "url": "https://bughunters.google.com/blog/the-great-google-password-heist-15-years-of-hacking-passwords-to-test-our-security-and-build-team-culture", "published_at": "2024-12-04T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100ffb2b82", "title": "Finding Bugs in Chrome with CodeQL", "url": "https://bughunters.google.com/blog/finding-bugs-in-chrome-with-codeql", "published_at": "2024-11-21T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0100fff65ae", "title": "Think Outside the Perimeter: Bug Hunting in Google Cloud's VPC Service Controls", "url": "https://bughunters.google.com/blog/think-outside-the-perimeter-bug-hunting-in-google-clouds-vpc-service-controls", "published_at": "2024-11-12T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01010878ccb", "title": "Certificate Error Mishandling: Misuse and Abuse of the SslErrorHandler Class", "url": "https://bughunters.google.com/blog/certificate-error-mishandling-misuse-and-abuse-of-the-sslerrorhandler-class", "published_at": "2024-10-28T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01010cf345b", "title": "Protecting Large Language Models", "url": "https://bughunters.google.com/blog/protecting-large-language-models", "published_at": "2024-10-04T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01010f4ad78", "title": "Non-Actionable Findings in 3rd-party Security Scanners...and How to Identify Them", "url": "https://bughunters.google.com/blog/non-actionable-findings-in-3rd-party-security-scannersand-how-to-identify-them", "published_at": "2024-09-16T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010115bad3d", "title": "CVR: The Mines of Kakadûm", "url": "https://bughunters.google.com/blog/cvr-the-mines-of-kakadûm", "published_at": "2024-09-10T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101226a0f4", "title": "Chrome VRP Reward Updates to Incentivize Deeper Research", "url": "https://bughunters.google.com/blog/chrome-vrp-reward-updates-to-incentivize-deeper-research", "published_at": "2024-08-28T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010123b6494", "title": "Formally Verified Post-Quantum Algorithms", "url": "https://bughunters.google.com/blog/formally-verified-post-quantum-algorithms", "published_at": "2024-08-19T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101279e994", "title": "A deep dive into CVE-2023-2163: How We found and Fixed an eBPF Linux Kernel Vulnerability", "url": "https://bughunters.google.com/blog/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability", "published_at": "2024-08-08T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01012b61ff5", "title": "Increasing Google & Alphabet VRP rewards up to $151,515", "url": "https://bughunters.google.com/blog/increasing-google-alphabet-vrp-rewards-up-to-151515", "published_at": "2024-07-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010138b1be5", "title": "Securing the Container World with Policies: acjs and ctrdac", "url": "https://bughunters.google.com/blog/securing-the-container-world-with-policies-acjs-and-ctrdac", "published_at": "2024-07-08T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01013927689", "title": "Enabling Trusted Types in a Complex Web Application: A Case Study of AppSheet", "url": "https://bughunters.google.com/blog/enabling-trusted-types-in-a-complex-web-application-a-case-study-of-appsheet", "published_at": "2024-07-01T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101435748d", "title": "Cryptographic Agility and Key Rotation", "url": "https://bughunters.google.com/blog/cryptographic-agility-and-key-rotation", "published_at": "2024-06-24T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01014cca53e", "title": "Announcing Bugcrowd as a new bughunters.google.com payment option", "url": "https://bughunters.google.com/blog/announcing-bugcrowd-as-a-new-bughuntersgooglecom-payment-option", "published_at": "2024-06-18T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01015bf753d", "title": "Time to challenge yourself in the 2024 Google CTF", "url": "https://bughunters.google.com/blog/time-to-challenge-yourself-in-the-2024-google-ctf", "published_at": "2024-06-12T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01016051492", "title": "Google’s ESCAL8 conference: Where esports, bug hunting, and inspiring new talent come together!", "url": "https://bughunters.google.com/blog/googles-escal8-conference-where-esports-bug-hunting-and-inspiring-new-talent-come-together", "published_at": "2024-06-03T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101657324d", "title": "Why Hybrid Deployments Are Key to Secure PQC Migration", "url": "https://bughunters.google.com/blog/why-hybrid-deployments-are-key-to-secure-pqc-migration", "published_at": "2024-05-21T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01017139393", "title": "One Year of Mobile VRP – Reward Increases and Lessons Learned", "url": "https://bughunters.google.com/blog/one-year-of-mobile-vrp-reward-increases-and-lessons-learned", "published_at": "2024-04-30T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01017462633", "title": "Preventing Cross-Service UDP Loops in QUIC", "url": "https://bughunters.google.com/blog/preventing-cross-service-udp-loops-in-quic", "published_at": "2024-03-26T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01017de053a", "title": "Tsunami Network Scanner & AI Security", "url": "https://bughunters.google.com/blog/tsunami-network-scanner-ai-security", "published_at": "2024-03-19T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101898f0af", "title": "Google's Threat model for Post-Quantum Cryptography", "url": "https://bughunters.google.com/blog/googles-threat-model-for-post-quantum-cryptography", "published_at": "2024-03-11T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010194286d0", "title": "The Family of Safe Golang Libraries is Growing!", "url": "https://bughunters.google.com/blog/the-family-of-safe-golang-libraries-is-growing", "published_at": "2024-02-26T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e010196fd4b5", "title": "Nom for Security: A Proactive Security Review of Nomulus", "url": "https://bughunters.google.com/blog/nom-for-security-a-proactive-security-review-of-nomulus", "published_at": "2024-02-20T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e01019d16ec2", "title": "LLVM's 'RFC: C++ Buffer Hardening' at Google", "url": "https://bughunters.google.com/blog/llvms-rfc-c-buffer-hardening-at-google", "published_at": "2024-02-12T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101aa67473", "title": "TensorFlow Threat Model and Security Guidelines Update", "url": "https://bughunters.google.com/blog/tensorflow-threat-model-and-security-guidelines-update", "published_at": "2024-02-05T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101b281d4a", "title": "Externalizing the Google Domain Tiers Concept", "url": "https://bughunters.google.com/blog/externalizing-the-google-domain-tiers-concept", "published_at": "2024-01-30T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101bf26675", "title": "A Recipe for Scaling Security", "url": "https://bughunters.google.com/blog/a-recipe-for-scaling-security", "published_at": "2024-01-22T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101cd279d5", "title": "Fixing Debug Log Leakage with Safe Coding", "url": "https://bughunters.google.com/blog/fixing-debug-log-leakage-with-safe-coding", "published_at": "2024-01-15T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101d16b3cc", "title": "The Tale of Google’s Response to Reptar CPU Vulnerability", "url": "https://bughunters.google.com/blog/the-tale-of-googles-response-to-reptar-cpu-vulnerability", "published_at": "2023-12-12T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101df33b18", "title": "LLVM CFI and Cross-Language LLVM CFI Support for Rust", "url": "https://bughunters.google.com/blog/llvm-cfi-and-cross-language-llvm-cfi-support-for-rust", "published_at": "2023-12-08T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101ebbd001", "title": "The Reptar CPU Vulnerability", "url": "https://bughunters.google.com/blog/the-reptar-cpu-vulnerability", "published_at": "2023-12-06T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101ec712dd", "title": "Securely Hosting User Data in Modern Web Applications", "url": "https://bughunters.google.com/blog/securely-hosting-user-data-in-modern-web-applications", "published_at": "2023-11-03T00:00:00+00:00" }, { "id": "01a0b5c6-bd0a-7055-9137-e0101f31458b", "title": "No More Speculation: Exploiting CPU Side-Channels for Real", "url": "https://bughunters.google.com/blog/no-more-speculation-exploiting-cpu-side-channels-for-real", "published_at": "2023-08-21T00:00:00+00:00" } ] posts Claim your blog
Back to bughunters.google.com
Blog · corpus.blog/blogs/bughunters.google.com/posts

bughunters.google.com

bughunters.google.com

2026

Google's PageBreak Project – Real-World Findingsoriginal ↗
24 Sept 2026
ESCAL8 2026: Agentic Hacking in the Lion Cityoriginal ↗
18 Sept 2026
Breaking into Google's GFile for $100koriginal ↗
11 Sept 2026
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rustoriginal ↗
24 Aug 2026
More Cryptanalysis Makes Us All Saferoriginal ↗
10 Aug 2026
Bug Hunting on Gemini Sparkoriginal ↗
5 Jun 2026
Bit Rot Doesn't Always Increase Entropy – A Story from the Archivesoriginal ↗
4 Jun 2026
Where to Go Next with Quantum-Safe Certificatesoriginal ↗
1 Jun 2026
A Look at Hardware Security Keys for Passkeysoriginal ↗
27 May 2026
bugSWAT in Seoul – April 2026original ↗
11 May 2026
Evolving the Android & Chrome VRPs for the AI Eraoriginal ↗
30 Apr 2026
Standardizing Rewards in Google VRP: Introducing Information Tiers and Action Criticalityoriginal ↗
8 Apr 2026
Passkeys are Your New Best Friendoriginal ↗
30 Mar 2026
Streamlining Google’s OSS VRP: Key Rule Updatesoriginal ↗
19 Mar 2026
Google VRPs in Review – 2025original ↗
11 Mar 2026
Mitigating URL-based Exfiltration in Geminioriginal ↗
9 Mar 2026
Hybrid Transport Goes Offline!original ↗
4 Mar 2026
Hybrid Protocol: The JSON Upgradeoriginal ↗
23 Feb 2026
Strengthening the Foundation: A Joint Security Review of Intel TDX 1.5original ↗
10 Feb 2026
A Beginners Guide: Cross-Device Passkeysoriginal ↗
3 Feb 2026
The Evolution of FIDO Experiences on Androidoriginal ↗
27 Jan 2026

2025

Task Injection – Exploiting agency of autonomous AI agentsoriginal ↗
11 Dec 2025
Google's Commitment to a Quantum-Safe Future: Why PQC is Google's Path forward and not QKDoriginal ↗
1 Dec 2025
Effortless Web Security: Secure by Design in the Wildoriginal ↗
14 Nov 2025
ESCAL8 2025: Gathering Cybersecurity Expertise in Mexico Cityoriginal ↗
7 Nov 2025
Announcing Google’s New AI Vulnerability Reward Program!original ↗
6 Oct 2025
Google Cloud VRP: Enhancing Transparency and Impact in Our Rewards Programoriginal ↗
25 Sept 2025
Level Up Your Reports: Introducing Our Updated Report Quality Frameworkoriginal ↗
22 Sept 2025
Project Rain:L1TForiginal ↗
19 Sept 2025
Beyond Sandbox Domains: Rendering Untrusted Web Content with SafeContentFrameoriginal ↗
18 Sept 2025
ESCAL8 de Google: ¡Hacking, Héroes y Horizontes en la Ciudad de México! (ESCAL8 is coming to Mexico!)original ↗
17 Sept 2025
Hardening Google Cloud: Insights from the latest Cloud VRP bugSWAToriginal ↗
10 Sept 2025
A Fuzzy Escape - A tale of vulnerability research on hypervisorsoriginal ↗
18 Aug 2025
Exploiting Retbleed in the real worldoriginal ↗
7 Aug 2025
New Patch Rewards Program for OSV-SCALIBRoriginal ↗
7 Aug 2025
Escaping '' in attributes – how it helps protect against mutation XSSoriginal ↗
12 Jun 2025
AI bugSWAT in Tokyo & 2025 Hacker Roadshoworiginal ↗
3 Jun 2025
Android VRP Announces AutoRepro – $1,000 bonus for eligible submissions!original ↗
26 Mar 2025
Google VRPs in Review – 2024original ↗
17 Mar 2025
Zen and the Art of Microcode Hackingoriginal ↗
5 Mar 2025
A Deep Dive into JS Trusted Types Violationsoriginal ↗
27 Feb 2025
Secure by Design: Google's Blueprint for a High-Assurance Web Frameworkoriginal ↗
4 Feb 2025
Level Up Your Open Source Karma (And Your Wallet) by Improving Securityoriginal ↗
21 Jan 2025
Capturing the Flags of the Internet: Find 0-days in OSS and write scanners to detect themoriginal ↗
8 Jan 2025

2024

Celebrating One Year of AI Bug Bounties at Alphabetoriginal ↗
17 Dec 2024
The Great Google Password Heist: 15 years of hacking passwords to test our security (and build team culture!)original ↗
4 Dec 2024
Finding Bugs in Chrome with CodeQLoriginal ↗
21 Nov 2024
Think Outside the Perimeter: Bug Hunting in Google Cloud's VPC Service Controlsoriginal ↗
12 Nov 2024
Certificate Error Mishandling: Misuse and Abuse of the SslErrorHandler Classoriginal ↗
28 Oct 2024
Protecting Large Language Modelsoriginal ↗
4 Oct 2024
Non-Actionable Findings in 3rd-party Security Scanners...and How to Identify Themoriginal ↗
16 Sept 2024
CVR: The Mines of Kakadûmoriginal ↗
10 Sept 2024
Chrome VRP Reward Updates to Incentivize Deeper Researchoriginal ↗
28 Aug 2024
Formally Verified Post-Quantum Algorithmsoriginal ↗
19 Aug 2024
A deep dive into CVE-2023-2163: How We found and Fixed an eBPF Linux Kernel Vulnerabilityoriginal ↗
8 Aug 2024
Increasing Google & Alphabet VRP rewards up to $151,515original ↗
11 Jul 2024
Securing the Container World with Policies: acjs and ctrdacoriginal ↗
8 Jul 2024
Enabling Trusted Types in a Complex Web Application: A Case Study of AppSheetoriginal ↗
1 Jul 2024
Cryptographic Agility and Key Rotationoriginal ↗
24 Jun 2024
Announcing Bugcrowd as a new bughunters.google.com payment optionoriginal ↗
18 Jun 2024
Time to challenge yourself in the 2024 Google CTForiginal ↗
12 Jun 2024
Google’s ESCAL8 conference: Where esports, bug hunting, and inspiring new talent come together!original ↗
3 Jun 2024
Why Hybrid Deployments Are Key to Secure PQC Migrationoriginal ↗
21 May 2024
One Year of Mobile VRP – Reward Increases and Lessons Learnedoriginal ↗
30 Apr 2024
Preventing Cross-Service UDP Loops in QUICoriginal ↗
26 Mar 2024
Tsunami Network Scanner & AI Securityoriginal ↗
19 Mar 2024
Google's Threat model for Post-Quantum Cryptographyoriginal ↗
11 Mar 2024
The Family of Safe Golang Libraries is Growing!original ↗
26 Feb 2024
Nom for Security: A Proactive Security Review of Nomulusoriginal ↗
20 Feb 2024
LLVM's 'RFC: C++ Buffer Hardening' at Googleoriginal ↗
12 Feb 2024
TensorFlow Threat Model and Security Guidelines Updateoriginal ↗
5 Feb 2024
Externalizing the Google Domain Tiers Conceptoriginal ↗
30 Jan 2024
A Recipe for Scaling Securityoriginal ↗
22 Jan 2024
Fixing Debug Log Leakage with Safe Codingoriginal ↗
15 Jan 2024

2023

The Tale of Google’s Response to Reptar CPU Vulnerabilityoriginal ↗
12 Dec 2023
LLVM CFI and Cross-Language LLVM CFI Support for Rustoriginal ↗
8 Dec 2023
The Reptar CPU Vulnerabilityoriginal ↗
6 Dec 2023
Securely Hosting User Data in Modern Web Applicationsoriginal ↗
3 Nov 2023
No More Speculation: Exploiting CPU Side-Channels for Realoriginal ↗
21 Aug 2023