Google Pays $90,000 for RCE Vulnerability

A researcher discovered a remote code execution flaw in Google's developer documentation sites by exploiting a signed Flask session cookie containing a pickle payload. The vulnerability allowed attackers to run arbitrary code like time.sleep on Google's servers. Google awarded a $90,000 reward for the exceptional report quality after fixing the issue across multiple domains including firebase.google.com and developer.android.com.