Google has built an internal AI system called PageBreak that has uncovered over 500 confirmed cross-site scripting (XSS) vulnerabilities in its own web applications. The system was designed to not just flag potential issues, but to validate them by actually testing exploit paths, reducing false alarms and ensuring security teams only deal with real threats.
How PageBreak Works
Launched as a pilot in November 2025 and formalized as a full project in January 2026, PageBreak integrates Gemini models in a workflow that emphasizes proof-driven testing. It examines application code and traffic signals to propose potential weaknesses. But instead of sending every AI-generated report downstream, PageBreak uses a validation layer: for XSS flaws, it injects JavaScript into live test environments via browser-like systems to verify if the suspicious code can really execute. It uses similar techniques to assess other classes of vulnerabilities—SQL injection, path traversal, remote code execution, server-side request forgery—and this verification approach appears to drive its near-zero false-positive rate.
Uncovering Exploit Chains and Hidden Risks
Beyond single input flaws, PageBreak exposed more complex exploit chains in several critical parts of Google’s infrastructure. One involved a cache-poisoning bug in Google’s JavaScript file server: Path segments from URLs, once injected into returned code and excluded from the cache key, could allow malicious responses to be cached and served to other users. Another case concerned the admin console: an unverified redirect value that was ultimately signed by a different endpoint, letting it reach a protected context and act like an XSS vulnerability. A third chain targeted the Tag Assistant Extension, where weak external connection checks, recovery of a one-time random token (nonce), and unsafe message forwarding let attacker-supplied script content reach debug pages. In combination with data URLs, this enabled arbitrary JavaScript execution—a universal XSS.
Google’s report notes that as of September 4, 2026, only two serious XSS vulnerabilities remained in applications using its high-assurance web frameworks—and both were internal or debug-facing with weaker safeguards. This suggests that strict framework controls may block entire classes of web flaws.
PageBreak’s development reflects a shift in how large organizations approach vulnerability detection. The system’s automated patching initiatives aim to reduce the manual effort product teams face—ideally, they’ll only need to verify proposed fixes instead of re-evaluating AI-generated reports. Google also acknowledges that no validator is perfect and that engineers still play a role in reviewing exploit paths before code changes reach production.
Security teams outside of Google are already familiar with false positives arising from AI-based scanners. PageBreak’s novelty lies in its proof-of-concept step: it only escalates flaws once an exploit can be demonstrated, not just theorized.
Why This Matters
Web applications are a frequent target for XSS attacks, which can allow attackers to run unauthorized scripts in users’ browsers—steal cookies, hijack sessions, or misdirect users. Traditional scanners often generate alarm fatigue, overwhelming engineers with potential but unverified flaws. An AI-backed system like PageBreak that produces validated, working exploit chains cuts through that noise and helps prioritize actual risks.
This development also underscores broader trends in cybersecurity: using AI not just for prediction or detection, but to carry out validation and real-world proofing. As organizations scale, automated verification becomes essential to stay ahead of attackers, not just catch up.
The Bigger Picture: PageBreak is one example of AI helping fortify defenses by combining machine learning with rigorous testing. But no matter how advanced, tools need ongoing evaluation and refinement. Watching how Google’s validator handles rare edge cases—or whether attackers find a way around its safeguards—will offer lessons for the wider security community.
