Search this site
Non-qualifying findings
Improving your reports
Behind the Scenes
Report vulnerability
Reward Program Rules
Home
Android
Bugs with no security impact
I wrote or found a malicious application
Intended Behavior
Low Severity Issues
Reports on non-eligible device versions
Bag of Tricks
Behind the Scenes
Blog Posts
Frequently asked questions
Life of a Reward
Our Rewards Philosophy
Presentations
Statistics and Charts
Best reports
Account Recovery XSS
Open redirects that matter
Improving your reports
Auth Bypass Bugs
Avoid videos... but if you can't, here are some tips :-)
Help us quickly reproduce the bug
How to submit a complete bug report applicable to Android applications
How to submit a complete bug report applicable to Android platform
Reporting URLs that give users access to resources
Use your native language
Verify the output of the tools
What is a security vulnerability?
What is an abuse risk?
When reporting XSS, don't use alert(1)
Write down the attack scenario
Non-qualifying findings
"Back" button that keeps working after logout
Ability to map e-mail addresses to profile names
AngularJS expression sandbox bypass
Attacks facilitating phishing or social engineering
Attacks working only when sharing local account with the attacker
Bugs in recent acquisitions
Bugs in vendor or partner-operated web applications
Commonly reported SSL/TLS vulnerabilities
Cookies that keep working after logout
CSRF in the logout handler
CSV Excel formula injection
Do-it-yourself XSS
Download / print / copy protection bypasses in Drive
Gmail attachment filter bypass
Invalid SPF policy and e-mail spoofing issues
IP/port scanning via Google services
Lack of HSTS (HTTP Strict Transport Security)
Lack of X-Frame-Options without a well-defined risk
Limited content reflection or content spoofing
Open redirectors
Phishing by navigating browser tabs
reCAPTCHA accepting an invalid response to a challenge
Reflected File Download
Unrealistically complicated clickjacking attacks
Using Google Account Recovery to hijack test accounts
XSLeaks and XS-Search
XSRF or clickjacking with no practical use to attackers
XSRF that requires the knowledge of a secret
XSS bugs in sandbox domains
XSS or XSRF that requires header injection
YouTube background playback protection bypass
Behind the Scenes
>
Statistics and Charts
Previous Years
2014
2015
2016
