Gemini Download Links Served Images Its Safety Filters Had Refused, Exposing a Delivery-Path Flaw
The Google Gemini web application returned images its own safety filters had refused, but only through the download control, while the chat showed a different, permitted image. Researcher Jason Kao of Fog Security reported it to Google through its Vulnerability Reward Program on June 25, 2026. Google first classed the report as out of scope, then in September decided not to track it as an abuse bug. Google has published no advisory, and the reporting names no CVE or CVSS score. Criticity is medium: the exposed content is the requesting user's own rejected output, with no cross-user exposure or privilege escalation reported, though the gap in enforcement is real.
Detalhes técnicos
- Inline views and downloads used separate paths, both on lh3.googleusercontent.com and bound to the signed-in user. Inline URLs end in =s1024-rj and download URLs end in =s0-d-I. The links did not resolve in an incognito session.
- Reproduction: a request that triggered a safety refusal was followed by a different, permitted request. The download control then returned the earlier refused artifact, ranging from blurry or incomplete generations to fully formed images, across several days and sessions.
- Behaviour changed over time: on October 15 rejected images were still retrievable from earlier conversations, while on October 22 those conversations downloaded the expected images and twelve later attempts did not reproduce the issue.
- The suspected cause is a state-management flaw involving image generation, safety interruptions and artifact cleanup. Fog Security describes this as a hypothesis that has not been confirmed as the root cause.
- The chat refusal itself held. The research is not a conventional model jailbreak. Testing covered a copyrighted character, a synthetic person and the researcher's own likeness, and excluded child-safety categories and real third-party subjects.
Remediação
- Fog Security recommends binding each download to the displayed, approved image and removing artifacts from refused or failed generations (cybersecuritynews.com).
- The reporting names no customer-side patch, setting or workaround. The fix is on the Google side, and Google has not given an implementation date.
- AI safety testing should cover stored files and download links, not only chatbot replies (cybersecuritynews.com).
Linha do tempo
-
Gemini Download Links Served Images Its Safety Filters Had Refused, Exposing a Delivery-Path Flaw
ler a análise desta fonte ocultar
The Google Gemini web application returned images its own safety filters had refused, but only through the download control, while the chat showed a different, permitted image. Researcher Jason Kao of Fog Security reported it to Google through its Vulnerability Reward Program on June 25, 2026. Google first classed the report as out of scope, then in September decided not to track it as an abuse bug. Google has published no advisory, and the reporting names no CVE or CVSS score. Criticity is medium: the exposed content is the requesting user's own rejected output, with no cross-user exposure or privilege escalation reported, though the gap in enforcement is real.
Technical Details
- Inline views and downloads used separate paths, both on lh3.googleusercontent.com and bound to the signed-in user. Inline URLs end in =s1024-rj and download URLs end in =s0-d-I. The links did not resolve in an incognito session.
- Reproduction: a request that triggered a safety refusal was followed by a different, permitted request. The download control then returned the earlier refused artifact, ranging from blurry or incomplete generations to fully formed images, across several days and sessions.
- Behaviour changed over time: on October 15 rejected images were still retrievable from earlier conversations, while on October 22 those conversations downloaded the expected images and twelve later attempts did not reproduce the issue.
- The suspected cause is a state-management flaw involving image generation, safety interruptions and artifact cleanup. Fog Security describes this as a hypothesis that has not been confirmed as the root cause.
- The chat refusal itself held. The research is not a conventional model jailbreak. Testing covered a copyrighted character, a synthetic person and the researcher's own likeness, and excluded child-safety categories and real third-party subjects.
Remediation
- Fog Security recommends binding each download to the displayed, approved image and removing artifacts from refused or failed generations (cybersecuritynews.com).
- The reporting names no customer-side patch, setting or workaround. The fix is on the Google side, and Google has not given an implementation date.
- AI safety testing should cover stored files and download links, not only chatbot replies (cybersecuritynews.com).