Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A developer investigation revealed that one user had successfully registered four separate accounts using only legitimate Gmail address variants that all route to the same mailbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com.
Colleagues noticed more user records than actual people in the database. The discrepancy traced back to a single line of code that compared email addresses as raw strings without normalization.
Gmail treats the local part of an address case-insensitively, discards everything after a plus sign, and ignores dots. These rules let one inbox generate an unlimited number of distinct strings that still receive mail at the same destination.
Why string comparison fails
Three common cases break naive equality checks:
- Case differences in the local part or domain
- Plus-addressing suffixes such as +shop or +promo
- Dots inserted anywhere in the local part of a Gmail address
Normalization must be applied selectively. Dots are ignored only for gmail.com and googlemail.com; applying the same rule to other providers would incorrectly merge unrelated mailboxes.
Homograph domain attacks
A separate but related threat appears when domains contain visually identical Cyrillic characters. The string еxample.ru (with Cyrillic е) encodes under IDNA to xn--xample-2of.ru, creating a look-alike address that passes superficial inspection yet points elsewhere.
Recommended implementation
Store two fields: the original address for sending mail and a normalized address for uniqueness enforcement. Perform lower-casing on the entire address, strip plus-suffixes only for Gmail, remove dots only for Gmail, and run every submitted domain through IDNA encoding to detect hidden non-ASCII labels. A simple confirmation email remains the most reliable validator of deliverability.
A diagnostic query can surface existing problems by grouping on the normalized domain and comparing raw versus deduplicated local parts.
Related articles
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.
Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild
Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.