Preliminary research

Breaking into Google's GFile for $100k

Arvin Shivram · Google Bug Hunters · 11 September 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Forged Firefly worker completion releases a file-copy task whose path prefix selects linked GFile storage backends under a production identity. Mamba batches pin requests to one process so failed copies bracket a hidden output filename; interpolation and an existence oracle recover it. Firefly then reads that output under a second service identity.

Record

Researcher

Arvin Shivram

Published by

Google Bug Hunters

Date

11 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• auth-bypass
• file-read
• info-leak
• abuse-of-functionality
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Arvin Shivram, first published at the original source. Preserved copies are kept so the citation survives its host.