Google’s PageBreak finds over 500 XSS flaws in its web apps

cryptonews03:38

Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications. Summary Google says PageBreak tests ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2670421015?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-26 03:38","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2670421015","market":"us","top_or_hot":-1,"title":"Google’s PageBreak finds over 500 XSS flaws in its web apps","media":"cryptonews","content":"<div>\n<p>Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications.\n\n\nSummary\n\n\n\nGoogle says PageBreak tests ...</p>\n\n<a href=\"https://crypto.news/googles-pagebreak-finds-over-500-xss-flaws/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Google’s PageBreak finds over 500 XSS flaws in its web apps</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nGoogle’s PageBreak finds over 500 XSS flaws in its web apps\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-26 03:38 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/googles-pagebreak-finds-over-500-xss-flaws/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications.\n\n\nSummary\n\n\n\nGoogle says PageBreak tests ...</p>\n\n<a href=\"https://crypto.news/googles-pagebreak-finds-over-500-xss-flaws/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":null,"symbol_name":null,"start_time":0,"source_url":"https://crypto.news/googles-pagebreak-finds-over-500-xss-flaws/","article_id":"2670421015","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/googles-pagebreak-finds-over-500-xss-flaws/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2670421015","pubTimestamp":1790365107,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications.Google says PageBreak tests suspected flaws against running applications before sending reports to product teams.The agent uses Gemini models for most scans and separate tools to confirm whether an exploit works.Applications built on Google’s high-assurance frameworks had two XSS findings as of Sep. 4.Google plans to connect PageBreak more closely with CodeMender, which generates security fixes.The Google Product Security team said PageBreak began as a pilot in November 2025 and became a formal project in January 2026. It tests Google’s own web applications and has found cross-site scripting, or XSS, flaws even on sensitive company domains. Google did not identify the affected applications in its announcement.Among hundreds of applications built on Google’s high-assurance web frameworks, PageBreak identified two XSS vulnerabilities as o","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{},"translate_title":"谷歌的 PageBreak 在其网络应用中发现 500 多个 XSS 漏洞","themeId":null,"isJumpTheme":false,"ttsUrl":"https://static.tigerbbs.com/2bf1337cfce1a8f48f074a0f814d66cb","symbols_score_info":{"SKYY":0.6,"GGLL":0.6,"GOOP":0.6,"GGLS":0.6,"SNPE":0.6,"GOOGL":1.98,"GOOY":0.6,"GOU":0.6,"OGIG":0.6,"GOOX":0.6,"GXPC":0.6,"EFIV":0.6,"GOOL":0.6,"XDAT":0.6,"LTL":0.6,"ILDR":0.6,"XLC":0.6,"GOGL":0.6,"CQTM":0.6,"VOX":0.6,"METV":0.6,"TRUC":0.6,"CMAG":0.6,"FCOM":0.6,"GOOW":0.6},"content_text":"Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications.\n\n\nSummary\n\n\n\nGoogle says PageBreak tests suspected flaws against running applications before sending reports to product teams.\nThe agent uses Gemini models for most scans and separate tools to confirm whether an exploit works.\nApplications built on Google’s high-assurance frameworks had two XSS findings as of Sep. 4.\nGoogle plans to connect PageBreak more closely with CodeMender, which generates security fixes.\n\n\n\nThe Google Product Security team said PageBreak began as a pilot in November 2025 and became a formal project in January 2026. It tests Google’s own web applications and has found cross-site scripting, or XSS, flaws even on sensitive company domains. Google did not identify the affected applications in its announcement.\nXSS occurs when an application allows an attacker’s script to run in another user’s browser. Depending on the application and the attacker’s access, the flaw can expose data or let someone act through an affected user’s session. Google reported more than 500 findings across its applications, but did not give a breakdown by product or severity.\nHow PageBreak confirms suspected flaws\nRather than sending every suspected bug to a product team, PageBreak passes each candidate to a specialized validator. For an XSS finding, the validator inserts a JavaScript payload, loads the affected page, and checks whether the script runs. Google said the validation step has kept the system’s false positive rate close to zero.\nThe agent can also test other types of flaws. According to Google, its validators check whether an injected input changes a database query, whether an application exposes a file through path traversal, or whether it can be made to execute code. A separate check looks for requests that an application sends to internal services.\nMost PageBreak scans use Gemini models, including Gemini 3.1 Pro and Gemini 3.5 Flash, although Google said the agent can work with different models. The validators themselves are not written by the AI agent. Google also runs agents through repeated attempts because a model can follow an unproductive path before finding a workable exploit.\nGoogle built the validation process in response to a problem its security staff had encountered: AI-generated reports can describe convincing attack paths that fail when tested. Under PageBreak’s process, unverified candidates stay within the security team’s workflow. They can guide later scans or help engineers build new validators, but Google said they are not sent to product teams as confirmed bugs.\nPageBreak found two flaws in protected applications\nAmong hundreds of applications built on Google’s high-assurance web frameworks, PageBreak identified two XSS vulnerabilities as of Sep. 4, Google said. Both were confined to internal applications or debug endpoints with gaps in their security protections. The result covers that group of applications; Google’s figure of over 500 findings covers its first-party web applications more generally.\nThe framework result gives Google a way to test how its application design holds up against repeated scans. PageBreak also has access to company tools that help it inspect applications at scale. Google said its code repository lets the agent follow paths across services, while security data from live web traffic can connect a requested page to the relevant source code. Existing scanners give it authenticated access to internal sites that can be difficult for an outside researcher to examine.\nThose resources help explain the scope of Google’s findings without suggesting that another organization could obtain the same results simply by running a Gemini model. PageBreak’s reported count comes from scans of Google’s applications with access to Google’s code, traffic data and testing systems.\nCrypto teams face the same verification workload\nThe problem of checking AI-generated security reports has also surfaced in crypto software. In July, Ethereum Foundation security research described a process in which agents develop potential findings and separate reviewers try to reproduce them. The foundation reported one confirmed flaw in libp2p, later disclosed as CVE-2026-34219, while warning that plausible reports can involve unreachable code or attack conditions that do not hold in practice.\nFor teams that handle crypto users’ funds, the difference between a candidate issue and a working exploit affects how quickly a report can lead to a fix. An August Bitcoin Red Team scan logged 7,958 findings across 501 open-source projects after 108 hours. At that point, 24.7% of the findings had reproducible proofs; the full tally did not represent 7,958 confirmed exploitable vulnerabilities.\nEarlier reporting on crypto bug bounties described a similar review burden. Cosmos Labs co-CEO Barry Plunkett said in April that submissions to its program had risen 900% from the previous year, including both valid and invalid reports. PageBreak is an internal Google tool, and Google has not said it is available to crypto projects.\nGoogle plans to pair findings with fixes\nEven after limiting reports to verified findings, Google said its product teams still receive a high volume of security work. PageBreak is therefore working with other Google projects, including CodeMender, an agent that generates bug fixes. Google plans to deepen that connection so product teams can review proposed fixes alongside confirmed vulnerabilities.\n\n\n\n\n\n                Read more:\n            \n\n                Cosmos Hub secures 1.23 million ATOM after Neutron attack","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.1","shortVersion":"4.50.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2670421015","isCrawlerRequest":true}