google Archives - Recon Bee

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

7Oct

By RBNo Comments

News

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has halted accepting product vulnerability reports through its bug bounty for open source software. The change, effective from October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers to the company for a reward. Reports about supply chain compromises are still accepted, and reports filed before October 1 are not affected by the change. Google called the stop temporary in a post on X (formerly Twitter) on October 1, and said it was due to significant increase in automated submissions, the vast majority of which are not valid. The post did not give figures. It did not say if the submissions were the result of AI-driven processes. The rules for the program, which is called Open Source Software Vulnerab...

Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse

12Aug

By RBNo Comments

News

Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse

According to Google, during the first quarter of 2026, Chrome's anti-abuse features decreased unsolicited notifications on Android by almost 7 billion per day. Google claims in a recent blog post that malware, phishing attempts, fraudulent payment requests, and scams are increasingly being distributed by notification abuse. Google created a "Swiss cheese" protection model to lessen exploitation, in which many overlapping systems attempt to prevent abuse at various stages. Google clarified, "Our goal is to make sure that if abuse slips thru one layer, another is there to catch it." By preventing misleading content from reaching consumers, this strategy enables us to stop misuse at its source while preserving a sound balance between read more about Google says Chrome cuts 7 billion...

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

4Aug

By RBNo Comments

News

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Three AI agent workflows were removed from Google's Python repository for the Agent Development Kit (ADK). A public GitHub issue could be used to trick a triage agent into activating a privileged code-fixing agent, as demonstrated by Pillar Security. The public agent might be prompt-injected to post /adk-issue-fix as adk-bot, according to the researchers. The comment satisfied the owner, member, or collaborator gate of the privileged workflow since they recognized the bot as a collaborator. The permission bridge was created using the trusted bot identity. The group showed how to exfiltrate the bot's personal access token (PAT) and execute arbitrary code on the continuous integration (CI) runner. Additionally, the privileged job had a Google Cloud service-account login and a Google A...

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

3Jul

By RBNo Comments

News

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices

NetNut, one of the largest networks that uses home devices as hired relays for other people's traffic, has been severely weakened by Google. Google's Threat Intelligence Group (GTIG) announced this week that it had cut the network's pool of viable devices by millions while collaborating with the FBI, Lumen, and other organizations. NetNut, also known as Popa, is a global network of home devices, including streaming boxes and smart TVs, according to Google. GTIG believes that the network has at least 2 million devices. Strangers can use your internet connection to route their own traffic if one of those devices is in your house, and your address is held accountable for their actions. Access to actual home internet addresses is sold by a residential proxy network. In order to ma...

Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

26Jun

By RBNo Comments

News

Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks

The Russian state-sponsored threat actor known as Turla has been ascribed to a previously unrecorded .STOCKSTAY is a NET backdoor that has been used against Ukrainian government and military institutions as well as groups with an interest in Italian foreign policy. The Google Threat Intelligence outfit (GTIG) described the Windows backdoor as being continuously updated by the hacker outfit and stated that the cyber espionage weapon shares significant code and functional overlaps with Kazuar, a staple implant used by the adversary since 2017. Malware development activities has been suspected since December 2022. According to GTIG, STOCKSTAY is a multi-component backdoor written in.NET using the Windows Forms architecture. It uses the open-source websocket-sharp library to establish a...

108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

14Apr

By RBNo Comments

News

108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

A cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure in a recent campaign, according to cybersecurity researchers. The campaign's objective is to gather user data and enable browser-level abuse by inserting advertisements and arbitrary JavaScript code into each page visited. The extensions have accumulated over 20,000 installs in the Chrome Web Store and are published under five different publisher identities: Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt, according to Socket. According to an investigation by security researcher Kush Pandya, all 108 send stolen passwords, user identities, and browsing data to servers under the control of the same operator. Of these, 45 extensions have a global ...

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released

16Feb

By RBNo Comments

News

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released

Google fixed a security hole in its Chrome browser that it claimed has been exploited in the wild on Friday by releasing security upgrades. Known as CVE-2026-2441 (CVSS score: 8.8), the high-severity vulnerability has been characterized as a CSS use-after-free flaw. Shaheen Fazim, a security researcher, is recognized for having identified and reported the vulnerability on February 11, 2026. According to a description of the vulnerability in NIST's National Vulnerability Database (NVD), a remote attacker could execute arbitrary code inside a sandbox via a crafted HTML site if Google Chrome's CSS was used after free before 145.0.7632.75. Google admitted that there is an attack for CVE-2026-2441 in the wild, but it did not reveal any information about how the vulnerability is being ...

Google disrupts IPIDEA residential proxy networks fueled by malware

30Jan

By RBNo Comments

News

Google disrupts IPIDEA residential proxy networks fueled by malware

Earlier this week, Google Threat Intelligence Group (GTIG) and industry partners destroyed IPIDEA, one of the biggest residential proxy networks utilized by threat actors. IPIDEA service-related domains, compromised device management, and proxy traffic routing were all taken down. Additionally, knowledge has been supplied on the IPIDEA software development kits (SDK) that distributed the proxying tool. With 6.7 million customers worldwide, IPIDEA is marketed by its proprietors as a VPN service that encrypts your internet traffic and conceals your true IP address. After hacking network devices, residential proxy networks redirect traffic using IP addresses belonging to home users or small businesses. Typically, the infection happens through trojanized programs read more about Goog...

Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats

9Dec

By RBNo Comments

News

Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats

Following the addition of agentic artificial intelligence (AI) capabilities to the web browser, Google introduced a series of new security improvements in Chrome on Monday. In order to prevent malicious actors from exploiting indirect prompt injections that come from exposure to untrusted web material and causing harm, the tech giant says it has put in place multilayer safeguards. The most important element is a User Alignment Critic, which independently assesses the agent's activities in a way that is separate from malevolent prompts using a second model. This strategy enhances Google's current methods, such as highlighting, which tell the model to follow user and system commands instead of what is embedded in a web page read more about Google Adds Layered Defenses to Chrome to Blo...

Google to flag Android apps with excessive battery use on the Play Store

17Nov

By RBNo Comments

News

Google to flag Android apps with excessive battery use on the Play Store

Google will begin taking action against Android apps that have excessive battery drain and heavy background activity in the official Google Play store. Applications that surpass a "bad behavior threshold" may have their visibility in the Android ecosystem impacted and may be reported on Google Play for having a detrimental effect on battery performance. Excessive partial wake locks is a new core Android Vitals measure that developers must upgrade their apps to comply with by March 1, 2026. Google worked together with Samsung to develop the technology, which has been in beta since April 14. According to Google, this is the first of several new metrics that will give you a better understanding of how your app uses resources, allowing you to enhance user experience throughout the An...