bugs.xdavidhu.mebugs

This blog shares the stories behind my best finds.
Interested in my latest disclosures?
Check out the Feed.
  • android - 10 Nov 2022

    Accidental $70k Google Pixel Lock Screen Bypass

  • gcloud - 31 Dec 2021

    Fixing the Unfixable: Story of a Google Cloud SSRF

  • google - 08 Oct 2021

    4 Weird Google VRP Bugs in 40 Minutes (video)

  • youtube - 05 Apr 2021

    I Built a TV That Plays All of Your Private YouTube Videos

  • youtube - 18 Jan 2021

    The Embedded YouTube Player Told Me What You Were Watching (and more)

  • youtube - 11 Jan 2021

    Stealing Your Private YouTube Videos, One Frame at a Time

  • google - 08 Mar 2020

    The unexpected Google wide domain check bypass