# Google DevSite: reflected XSS via language-selector 404 page

Server-side devsite-language-selector reflected URL path as HTML on 404 pages, enabling XSS on cloud.google.com and developers.google.com.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: NDevTK
- Disclosed: 2022-07-26
- Write-up quality: 6/10
- Original: https://ndevtk.github.io/writeups/2022/07/26/google-xss/
- Library page: https://bugbountylibrary.com/r/blog%3Andevtk-github-io-writeups-2022-07-26-google-xss
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:high technique:fuzzing technique:source-review vuln:xss

**Target:** DevSite 404 page / devsite-language-selector component
**Root cause:** Server-side rendering of <devsite-language-selector> reflected part of the URL path into HTML without encoding on the 404 page.
**Steps:**
1. Request `https://developers.google.com/foo%22%3E%3Cimg%20src=x%3E%3C/a%3E%3C/li%3E%3C/ul%3E%3C/devsite-language-selector%3E%3Ch1%3E%3Cscript%3Ealert(document.domain)%3C/script%3E/a`
2. Observe the path is reflected unencoded inside the language-selector markup, breaking out of the tag context
3. Script executes on cloud.google.com / developers.google.com origin
**How found:** DalFox scanner repeatedly flagged the same reflection on the 'not found' page, prompting manual inspection of the devsite-language-selector server-side rendering.
**Exploitation:** Craft a URL whose path closes the devsite-language-selector element and injects a <script>; victim visiting the link executes attacker JS on the Google origin.
**Insight:** Scanner noise on 404 pages can hide real reflections: when a fuzzer keeps hitting the same 'not found' response, inspect custom web components (like <devsite-language-selector>) whose server-side rendering may interpolate the URL path unencoded.