# Researcher discloses fixed Google developer-site code execution flaw

_Published Monday, October 12, 2026 at 12:19 PM EDT · Security · Latest · Tier 2 — Notable_

![Researcher discloses fixed Google developer-site code execution flaw — Primary](https://simonkoeck.com/og/google-devsite-flask-session-pickle-rce.png)

A security researcher disclosed a vulnerability in Google's shared DevSite platform that allowed code execution without a login, and said Google fixed the issue and awarded $90,000. The researcher demonstrated execution by making the server pause for specified intervals rather than running production commands.

A browser session cookie exposed an OAuth client secret that also served as the cookie's signing key. That allowed the researcher to forge trusted cookies containing serialized Python objects, which the server then loaded and executed.

The recovered key also signed valid sessions on Firebase and several Android documentation sites. The disclosure's timeline lists acceptance, a reward and a fix, but gives no dates for those steps.

## Sources

- [simonkoeck.com](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce)

---
Canonical: https://techandbusiness.org/newswire/y5jCv7zCx7aHDdnjKrS9HU
Published: 2026-10-12T16:19:31.124Z
Story chronology: 2026-10-12T07:28:53.000Z
Retrieved: 2026-10-12T18:45:33.064Z
Publisher: Tech & Business (techandbusiness.org)