Google vulnerability allowed to remove any pages from search. And it was used

Journalist Jack Paulson accidentally noticed that two of his articles had disappeared from Google search results. During his investigation, he discovered a vulnerability that allowed attackers to remove links from search without the consent of the content owners.

The problem was related to the Google Refresh Outdated Content tool, which is used to update the indexing of pages. Attackers used the difference in the case of letters in the URL, which caused a 404 error when re-crawling. As a result, Google removed not only the page with the error, but all URL variations, including active ones.

Paulson had previously published an article about the arrest of the company’s CEO on charges of domestic violence. This story subsequently disappeared from search – according to the journalist, precisely because of this vulnerability. An article by another journalist, Ahmed Zidan, suffered a similar problem.

Google confirmed the problem and said that it had already fixed it, stating that the incident affected only a small portion of pages. However, the company did not disclose the exact number of materials removed or provide information about those responsible.

Journalists are dissatisfied with Google’s lack of transparency and the inability to identify those responsible for removing content.