Google AI Finds 500+ XSS Flaws in Popular Products, Builds Exploit Chains

Key Takeaways

• Google’s internal AI security agent, PageBreak, has identified over 500 validated Cross-Site Scripting (XSS) vulnerabilities within its own web applications.
• Unlike traditional AI scanners, PageBreak utilizes a “proof-driven” methodology, actively exploiting suspected flaws in live environments to confirm their viability, thus minimizing false positives.
• The AI successfully constructed sophisticated exploit chains, including cache poisoning and administrative console XSS, demonstrating its capability to uncover complex, multi-stage vulnerabilities.
• PageBreak, operational since early 2026, leverages Gemini models and aims to streamline the vulnerability discovery and patching process by providing engineers with verified exploit proofs.

Google’s AI Security Agent Uncovers Hundreds of XSS Flaws

Google has unveiled an advanced internal AI security agent, dubbed PageBreak, which has successfully discovered more than 500 confirmed Cross-Site Scripting (XSS) vulnerabilities across various Google web applications. This system is engineered to pinpoint weaknesses that could enable attackers to execute unauthorized code within a user’s browser, even in sensitive online services. The development is particularly significant given the common issue of high false-positive rates associated with many AI-powered security scanners.

PageBreak distinguishes itself by rigorously testing each potential vulnerability in a live environment to generate concrete proof of concept exploits before escalating the issue to human engineers. This meticulous validation process drastically reduces the “noise” of unverified reports, allowing security teams to focus on genuine threats. This defensive testing initiative was highlighted by analysts at tl;dr sec in their October 1 roundup, underscoring its impact in proactive security.

According to a public report from Google, PageBreak initiated as a pilot program in November 2025 and transitioned into a full-scale project by January 2026. The system predominantly utilizes Gemini models within its workflow, emphasizing a proof-driven approach to security assessments.

How PageBreak Validates Vulnerabilities

PageBreak’s methodology involves analyzing code and network traffic patterns to theorize potential security flaws. Instead of immediately flagging these theories as definitive findings, the system submits them to a specialized validator. This validator then attempts to exploit the suspected weakness, treating the AI’s initial output as a hypothesis rather than a conclusive security report.

For XSS vulnerabilities, the validator injects JavaScript code, simulates a user accessing the target application through a browser-like testing environment, and verifies if the injected code successfully executes. This practical demonstration of the exploit is crucial. Google attributes its remarkably low false-positive rate to this rigorous verification step. The same validation framework is also adaptable for detecting other critical vulnerability types, including SQL injection, path traversal, remote code execution, and server-side request forgery.

This approach builds upon previous efforts where automated systems assisted in identifying, reproducing, triaging, and patching Chrome browser bugs. PageBreak enhances this process by adding a crucial layer of verification, ensuring that an exploit path is viable before it is brought to the attention of development teams.

The project also provided insights into the effectiveness of secure design principles. As of September 4, 2026, PageBreak identified only two XSS issues among hundreds of applications built using Google’s high-assurance web frameworks. These isolated instances were confined to internal applications or debug endpoints with identified hardening deficiencies, reinforcing the importance of consistent framework controls in mitigating entire categories of bugs.

Exploit Chains Expose Complex Risks

Beyond simple input validation flaws, PageBreak’s most notable discoveries involved complex exploit chains. One such finding was a cache-poisoning vulnerability affecting a JavaScript file server. The system identified that an unchecked segment of a URL path was being incorporated into the returned JavaScript code but was erroneously excluded from the cache key. This oversight allowed a malicious response to be cached and subsequently delivered to other users within the same geographical region.

While Google found no evidence of this cache flaw being exploited by external attackers, its potential impact was significant. It could have led to XSS on sensitive Google domains and external websites that loaded the compromised JavaScript, highlighting the inherent risks associated with CDN cache poisoning attacks where shared cached responses can transform a minor input vulnerability into widespread browser-side code execution.

Another intricate exploit chain targeted an administrative console. PageBreak uncovered that an unverified redirect value could be passed to `window.location`. Initially, a cryptographic signature mechanism prevented direct exploitation. However, the AI agent then discovered a separate authorization endpoint capable of generating a valid signature for a malicious JavaScript URI. This critical bypass effectively transformed a protected endpoint into a functional XSS vector.

The third significant case involved the Google Tag Assistant Extension. The AI identified a combination of weak checks on external connections, the recovery of a one-time nonce, and unsafe message forwarding that permitted attacker-controlled script content to be delivered to a page under debug. The extension’s support for data URLs then facilitated arbitrary JavaScript execution, resulting in a universal XSS condition.

Google’s strategy involves retaining unverified findings for future analysis and validator enhancements, rather than immediately forwarding them to product teams. The company acknowledges that current validators may not be exhaustive and could potentially miss genuine weaknesses. The reported findings underscore the value of integrating automated testing with robust, secure development frameworks, while still maintaining human engineer oversight for proposed fixes before they are deployed to users.

Google is actively collaborating with automated patching initiatives to manage the volume of confirmed vulnerability reports. The overarching goal is to shift the product teams’ focus from repeatedly investigating the validity of AI-generated reports to primarily validating proposed fixes, thereby streamlining the security remediation process.

The following indicators are provided for reference and represent affected domains and test artifacts, not confirmed malicious infrastructure. They should not be used as a blocklist.

Indicators of Compromise (IoCs)

• Affected domain: apis.google.com (JavaScript-serving domain affected by cache poisoning; not malicious infrastructure.)
• Affected domain: admin.google.com (Administrative console affected by the chained XSS finding.)
• Domain: google.com (Parent domain referenced in the extension connection scenario.)
• Domain pattern: *.google.com (Allowed connection pattern discussed in the extension case.)
• Example path: /js/hello/file.js (Illustrative request showing how the server extracted an unchecked path segment.)
• Example path segment: /js/hello (Segment extracted from the illustrative request.)
• Proof-of-concept path: /js/"-alert(1)-"/api.js (Test request demonstrating JavaScript injection.)
• Proof-of-concept URL: https://apis.google.com/js/"-alert(1)-"/api.js (URL shown in the transformed JavaScript example, not observed attacker infrastructure.)
• File name: file.js (Illustrative JavaScript file name used in the routing example.)
• File name: api.js (JavaScript resource whose cache entry could be poisoned.)
• Endpoint path: /a/autodns/registrar (Administrative endpoint accepting the unvalidated redirect value.)
• Endpoint path: /a/autodns/authorize (Authorization endpoint used to obtain a valid signature for the malicious input.)
• Proof-of-concept URI: javascript:alert(1) (Demonstration payload for the administrative console XSS.)
• Proof-of-concept data URL: data:text/javascript,alert(1) (Demonstration payload for arbitrary script execution in the extension case.)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Regularly Patch and Update: Ensure all web applications, frameworks, and extensions are kept up-to-date with the latest security patches to address known vulnerabilities.
• Implement Secure Coding Practices: Developers should adhere to secure coding guidelines, particularly focusing on input validation, output encoding, and proper handling of user-supplied data to prevent XSS and other injection attacks.
• Utilize Web Application Firewalls (WAFs): Deploy WAFs to provide an additional layer of defense against XSS and other common web-based attacks by filtering malicious traffic.
• Conduct Regular Security Audits and Penetration Testing: Perform frequent security assessments, including automated scanning and manual penetration testing, to proactively identify and remediate vulnerabilities.
• Employ Content Security Policy (CSP): Implement a robust CSP to mitigate the impact of XSS attacks by controlling which resources the browser is allowed to load for a given page.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.