The vulnerability could allow attackers to see your files

Google always strives to keep our services as secure as possible. This time, however, we were able to detect a bug in Google Docs that could allow attackers to view your private files. According to thehackernews.com portal, it was discovered by a security researcher Sreeram KL. Within the program Vulnerability Reward Program by Google, was Sreeram KL valued at $ 3133.70.

Attackers could see your files in Google Docs with a screenshot

The stumbling block in this case was the feedback window. This allows users to send feedback along with the ability to include a screenshot that will load automatically. This feature is embedded on the main website (www.google.com) and integrated into other domains through the element iframe. This will display a feedback pop-up window from the page feedback.googleusercontent.com.

Taking a screenshot requires reading the RGB values ​​from each pixel on the screen and sending them to the parent domain, specifically google.com. This domain then redirects the obtained values ​​to the feedback domain, which renders the image and sends it back in data format. Base64.

In this case, an error occurs in the way the data is sent to the domain feedback.googleusercontent.com. Only then can an attacker change this address to any external site. This will allow an attacker to steal screenshots to be uploaded to Google’s servers. In order for this attack to be successfully executed, user interaction is initially required.

Fortunately, Google has already fixed a bug in the feedback window that an attacker could exploit to potentially steal screenshots of sensitive documents in its service.