NEW "LEAKYLOOKER" FLAWS IN GOOGLE LOOKER STUDIO COULD ENABLE CROSS-TENANT SQL QUERIES

Summary from the TLDR InfoSec newsletter

Researchers found nine cross-tenant issues in Google Looker Studio that allowed arbitrary SQL on connected data sources and broader GCP projects, including BigQuery, Spanner, PostgreSQL, MySQL, and Google Sheets. Attackers could hijack reports, reuse stored credentials, and trigger one-click data exfiltration via crafted reports and browser-side code.