Top 10 winner

XS-Searching Google's bug tracker to find out vulnerable source code

XS-Searching Google’s bug tracker to find out vulnerable source code

Luan Herrera and @lbherrera_ · Medium · 31 March 2019

Monorail's CSV export lacked CSRF protection and allowed a column to be repeated, so a search that matched a bug returned a hugely inflated file. Timing how long that response takes to enter the Cache API answers cross-origin yes/no questions, and binary search over Chromium's public directory tree leaks paths and line numbers named in private security bugs.

Record

Document

XS-Searching Google’s bug tracker to find out vulnerable source code

Researcher

Luan Herrera and @lbherrera_

Published by

Medium

Date

31 March 2019

Topic

Other

In the archive

• Ranked #10 in the 2018 Top 10 Web Hacking Techniques

Related sources

• Google bug tracker XS-Search exploit

Tags

• xsleak
• timing-attack
• side-channel
• csrf
• info-leak
• same-origin-policy
• cache
• cve
• bug-bounty
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Luan Herrera and @lbherrera_, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.