Googles PageBreak finds over 500 XSS flaws in its web apps
Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the companys web applications. The Google Product Security team said PageBreak began as a pilot in November 2025 and became a formal project in January 2026. It tests Googles own web applications and has found cross-site scripting, or XSS, flaws even on sensitive company domains. Google did not identify the affected applications in its announcement. XSS occurs when an application allows an attacker‘s script to run in another user’s browser. Depending on the application and the attacker‘s access, the flaw can expose data or let someone act through an affected user’s session. Google reported more than 500 findings across its applications, but did not give a breakdown by product or severity. How PageBreak confirms suspected flaws Rather than sending every suspected bug to a product team, PageBreak passes each candidate to a specialized validator. For an XSS finding, the validator inserts a JavaScript payload, loads the affected page, and checks whether the script runs. Google said the validation step has kept the systems false positive rate close to zero. The agent can also test other types of flaws. According to Google, its validators check whether an injected input
