Fact Check: Google awarded Brutecat $5,000 under its bug bounty program for discovering the security flaw.

Fact Check: "Google awarded Brutecat $5,000 under its bug bounty program for discovering the security flaw."

What We Know

The claim that "Google awarded Brutecat $5,000 under its bug bounty program for discovering the security flaw" is supported by multiple sources. According to The Hacker News, the security researcher known as "Brutecat" discovered a vulnerability in Google's account recovery feature that could allow attackers to brute-force a user's recovery phone number. Following the responsible disclosure of this flaw on April 14, 2025, Google awarded Brutecat a $5,000 bounty for this discovery, as confirmed by Dark Reading and The Register.

The vulnerability involved exploiting a deprecated version of the username recovery form, which lacked adequate anti-abuse protections, allowing for rapid attempts to guess the phone number linked to a Google account. Google promptly patched the vulnerability by removing the problematic form by June 6, 2025, demonstrating a quick response to the reported issue (The Register, Dark Reading).

Analysis

The evidence supporting the claim is robust, with multiple reputable sources confirming the details of the bug discovery and the subsequent bounty awarded. The information from The Hacker News provides a comprehensive overview of the vulnerability and the timeline of events, while Dark Reading and The Register corroborate the specifics about the $5,000 award.

However, it is important to note that while the claim is accurate, the context around the severity of the flaw and the bounty amount may suggest a more nuanced understanding of the situation. For instance, The Register mentions that Google did not consider the flaw particularly serious, which may reflect on the perceived value of the bounty in relation to the potential risks posed by the vulnerability. This could indicate a disparity between the severity of the flaw and the compensation awarded, which might be relevant for assessing the overall impact of the bug bounty program.

Conclusion

The claim that "Google awarded Brutecat $5,000 under its bug bounty program for discovering the security flaw" is Partially True. While the core of the claim is accurate, the context surrounding the severity of the vulnerability and the bounty amount suggests that there are additional considerations to take into account. The award reflects a recognition of the discovery, but the low amount relative to the potential risk may imply that the flaw was not viewed as critically dangerous by Google.

Sources

1. Google – Wikipedia
2. Researcher Found Flaw to Discover Phone Numbers Linked to Any Google ...
3. Google brute-force attack exposes phone numbers in minutes
4. Google Bug Allowed Brute-Forcing of Any User Phone Number
5. Google
6. Google Chrome ‑selain
7. Google - Apps on Google Play
8. Google Patches Security Flaw That Exposed Recovery Phone Numbers