Wednesday, May 28, 2025
HomeCVE/vulnerabilityGoogle Maps XSS Bug - Bounty Doubled After the Original Fix had...

Google Maps XSS Bug – Bounty Doubled After the Original Fix had Failed

Published on

SIEM as a Service

Follow Us on Google News

Google fixed the vulnerability with Google Maps that was reported through Google Vulnerability Reward Program (VRP) and in return, the researchers are paid with financial rewards.

The XSS vulnerability with Google Maps discovered by Zohar Shachar, Head of Application Security at Wix, and reported to Google through their bug bounty program.

XSS with Google Maps

The vulnerability resides in Google Maps that are used for creating your map. Once you have the maps created you can export them in various formats such as CSV, XLSX, KML, or GPX.

- Advertisement - Google News

Shachar exported the map in KML format that was used to display geographic data in an Earth browser such as Google Earth.

The map name was found to be present in the CDATA tag “which means our code will not be rendered by the browser.”

According to Shachar, “by adding ‘]]>’ at the beginning of your payload (I.e. as the beginning of the ‘map name’), you can escape from the CDATA and add arbitrary XML content (which will be rendered as XML) – leading immediately to XSS.”

He also provided the steps to reproduce the issue. The bug was reported to Google and they paid 5000$ bounty.

Bypassing the Fix

To fix the closing of the CDATA tag Google added another CDATA tag, Shachar reported the issue again to Google.

“I was genuinely surprised the bypass was so simple. I reported it so quickly (literally 10 minutes between checking my mailbox and reporting a bypass), that right after sending this mail I started doubting myself.”

Within two hours, Google acknowledged the issue and reopened the case, and updated the bug.

The first XSS issue was reported to Google on April 23 & fixed on June 7, the bypass to the patch reported on the same day and the issue fixed, the second payout provided on June 18. For each vulnerability report Shachar $5,000, so the total reward is $10,000.

“Ever since this Google-maps fix bypass incident I started to always re-validate fixes, even for simple things, and it has been paying off. I full-heartedly encourage you to do the same,” Shachar said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Also Read:

Lazarus APT Hackers Attack Japanese Organization Using Remote SMB Tool “SMBMAP” After Network Intrusion

PoetRAT – New Python RAT Attacking Government and Energy Sector Via Weaponized Word Documents

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

MATLAB, Serving Over 5 Million Users, Hit by Ransomware Attack

MathWorks, the renowned developer of MATLAB and Simulink, has been grappling with the aftermath...

CISA Publishes ICS Advisories Highlighting New Vulnerabilities and Exploits

On May 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a new...

Chrome Security Patch Addresses High-Severity Vulnerabilities Enabling Code Execution

The Chrome team at Google has officially released Chrome 137 to the stable channel...

Zero-Interaction libvpx Flaw in Firefox Allows Attackers to Run Arbitrary Code

Mozilla has released Firefox 139, addressing several critical and moderate security vulnerabilities that posed...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Severe WSO2 SOAP Flaw Allows Unauthorized Password Resets for Any Use

A newly disclosed vulnerability, CVE-2024-6914, has shocked the enterprise software community, affecting a wide...

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent...

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...