PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Leaking the email of any YouTube user for $10,000

brutecat.com | incident | #bug-bounty | #information-disclosure | #privacy | #youtube | #google | #gaia-id
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Blocking a YouTube live chat user leaks their obfuscated Gaia ID; forged protobuf request params extended this to any channel, and an old Google product chained it into email disclosure.
Published
Collected

Related coverage

incident · hackenproof.com
LinkedIn Data Breach: 66 Million Scraped Records Exposed in an Unsecured Database
An open MongoDB database exposed 66 million scraped LinkedIn profiles—what was taken, whether scraping like this is legal, and how it compares to LinkedIn's larger 2021 incident.
blog · brutecat.com
Disclosing YouTube Creator Emails for a $20k Bounty
Dumping hidden parameters in a YouTube Studio endpoint via error-based schema leaks exposed Content Manager data tied to Content ID, revealing private email addresses of monetized creators.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
blog · bughunters.google.com
ESCAL8 2026: Agentic Hacking in the Lion City
Check out this post to learn more about ESCAL8 2026, Google’s annual flagship security conference, coming to Singapore from October 23–25, 2026!
blog · bughunters.google.com
Breaking into Google's GFile for $100k
This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.
Back