The Vulnerability

The disclosure, titled "I Found a $90k Remote Code Execution Vulnerability in Google," describes a remote code execution flaw — a class of bug that can allow an attacker to run arbitrary code on a target system. The researcher reported the issue through Google's vulnerability reward program, which paid out $90,000 for the finding, per the researcher's account.

Scope and Limits

The write-up stands as the primary public documentation of the claim. Details of the affected Google product, the exploitation path, and whether the flaw has been fully patched are not independently detailed beyond the researcher's own report. No evidence was found in the review of sources indicating that any of the material relied on was inaccessible due to captchas, logins, or blocking.

The finding was assessed against eight primary sources.

The claim that a researcher found a $90,000 remote code execution vulnerability in Google is, on balance, accurate. Verdict: Mostly True