Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. “To earn this premier reward, you […]
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately […]
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection. […]
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. Major browsers and operating systems trusted the compromised certificates, potentially allowing attackers to impersonate legitimate websites and intercept encrypted communications. A […]
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. The technique, dubbed “Adception” by security researchers at Push Security, appears designed to evade advertising security checks by using Bing’s trusted domain as the ad destination, before redirecting victims through […]
Hackers hijack Google domains after breaching ccTLD registries
Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. Google underlines that the attacks affected domains of other organizations in the .GH, .SL, and .AS ccTLDs but “did not involve […]
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. The company’s OSS VRP incentivizes security researchers to responsibly disclose security flaws across open-source projects maintained by Google, including Golang, Angular, Bazel, Protocol Buffers, Fuchsia, and critical third-party dependencies, as well as repository settings […]
Google Gemini could soon get full access to your Mac’s files, apps and the web
Google’s Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. As spotted by TestingCatalog on X, Google is testing desktop control for Gemini, and there are references to a new hidden “Additional sandbox options” setting in the Gemini Desktop app. […]
Google fined €403 million over location data privacy violations
Ireland’s Data Protection Commission (DPC) has fined Google €403 million ($463M) for multiple GDPR violations related to processing users’ location data. The agency launched an investigation in February 2020 after receiving multiple complaints from consumer rights organizations. It examined three Google features that were active during the GDPR application period from May 25, 2018, through […]
Google warns of new Chrome zero-day bug exploited in attacks
Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year. “Google is aware that an exploit for CVE-2026-87491 exists in the wild,” the company said in a Tuesday security advisory. The company began rolling out patched versions to Windows (153.0.8010.36), Mac […]