Collected research

Excel formula injection in Google Docs

Digital Security Research Group: Excel formula injection in Google Docs

@_chipik and @asintsov · dsecrg.blogspot.com

Google Docs Forms neutralised spreadsheet formulas by prefixing a space, so the researchers submitted %08 (backspace) ahead of the = to delete that space and land a live formula in the results sheet. A Google Function inside the injected formula then issued a GET to an attacker host carrying the contents of other cells. Reported through Google's reward programme.

Record

Document

Digital Security Research Group: Excel formula injection in Google Docs

Researcher

@_chipik and @asintsov

Published by

dsecrg.blogspot.com

Topic

Injection

In the archive

• Collected in the 2011 research round

Tags

• injection
• filter-bypass
• info-leak
• encoding
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of @_chipik and @asintsov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.