GERRIT MISCONFIGURATION EXPOSED GOOGLE PROJECTS TO MALICIOUS CODE INJECTION

Summary from the TLDR InfoSec newsletter

Tenable researchers discovered a misconfiguration in Google's Gerrit code collaboration platform that could have allowed attackers to inject malicious code into popular Google projects like ChromiumOS, Bazel, and Dart through supply chain attacks. The vulnerability, dubbed "GerriScary" (CVE-2025-1568), exploited improper permissions for the addPatchSet feature and a race condition in the automated merge process, allowing attackers to modify approved code changes without triggering new reviews. Google fixed the issue across all Chrome/ChromeOS-related projects after Tenable's October 2024 report, awarded a $5,000 bug bounty, and found no evidence of prior exploitation.