I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit.

Thing is, its stored on a google server in a directory it really shouldnt be. This allowed it to evade my block list.

Is there some way I can inform google about this? Can anybody with more experience tell me if I should do that?

It is served from storage.googleapis.com (https) in a directory for the prototype library. That, to me, seems not good. I have the JS code if anybody wants to see it, its really long so I dont want to put it here.

  • 2
    Why shouldn't you inform Google? If it's as serious as you think it is, I'm pretty sure it'd be better for everyone to inform Google.
    – tangrs
    Commented Mar 28, 2016 at 7:02

1 Answer 1


Firstly, you should establish whether it actually is malicious (or can be exploited maliciously by third parties).

Google has a dedicated page for reporting bugs, vulnerabilities, fraud and malware. There is more information on Google's security philosophy page.

I don't see a reason why you shouldn't inform them of this. However, before you do so, you should double check that it is not just an issue with your computer (i.e. local malware injecting content into your browser pages) and that it is reproducible.

  • The danger with "establish if it can actually be exploited" is that unexperienced people will try to figure out how it works and end up getting infected: Commented Mar 28, 2016 at 7:28
  • It's definitely malicious. Or, at least it was in about 2008. It looks for very old vulnerable browsers and tries to exploit them. The SWF is served from a known malware domain. I checked it all out in a VM on a well-patched linux host with no flash, so no worries about self infection. Thanks for the link, my google-fu must have been weak.
    – jeremy
    Commented Mar 29, 2016 at 4:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .