# XSS->Fix->Bypass: 10000$ bounty in Google Maps

Google Maps KML export wrapped map names in CDATA; injecting ]]> escaped it for SVG XSS, and the fix was bypassed with nested CDATA.

- Payout: $10,000
- Severity: medium
- Program: Google
- Credited: Zohar Shachar
- Disclosed: 2020-09-07
- Write-up quality: 6/10
- Original: https://www.ehpus.com/post/xss-fix-bypass-10000-bounty-in-google-maps
- Library page: https://bugbountylibrary.com/r/blog%3Aehpus-com-post-xss-fix-bypass-10000-bounty-in-google-maps
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:incomplete-fix technique:source-review vuln:xss

**Target:** Google Maps 'export as KML' endpoint
**Root cause:** Map name was embedded in a CDATA block without sanitizing the ]]> terminator, allowing XML breakout; the fix merely wrapped input in another CDATA tag, which nested CDATA closers could still escape.
**Steps:**
1. Create a Google Maps custom map named `]]><svg onload=alert(1)>`
2. Export the map as KML
3. Observe the XML response where the name is placed inside CDATA
4. The `]]>` closes the CDATA and the SVG payload renders as XML, triggering XSS
5. After fix, use `]]>]]><svg onload=alert(1)>` to close both nested CDATA tags and bypass
**How found:** Researcher noticed the map name was reflected inside a CDATA tag and reasoned about how to close CDATA (`]]>`), then tested the payload. After the fix, he re-exported the same payload, saw the input was simply wrapped in an additional CDATA tag, and reasoned that two open CDATA tags require two closing sequences.
**Exploitation:** Attacker crafts a map name containing `]]>` plus an SVG XSS payload; when the victim opens the exported KML response, the CDATA is broken out of and the SVG executes in the browser origin.
**Insight:** When a fix wraps untrusted input in a delimiter (CDATA, comments, quotes) rather than escaping the delimiter itself, test whether nesting the delimiter lets you close multiple layers at once; always re-validate 'fixed' bugs.