Researcher Reports Two Flaws in Gmail and Google Drive Integration

A security researcher has demonstrated that attackers can use Google Drive to deliver malicious files that bypass Gmail's attachment scanner and appear with a "Scanned by Gmail" label. Ben Ilkashi, a security researcher at Pentera Labs, reported the flaw after a 90-day responsible disclosure period.

The issue was first reported through the Google Bug Hunters program on December 14, 2025. Google confirmed it was a duplicate of an internally tracked issue, and on January 22 its Trust and Safety unit stated no fix timeline was available.

How the First Flaw Works Ilkashi found that a malicious SVG file blocked by Gmail with a "virus detected" label could still be uploaded to Google Drive. Google Drive did not classify the file as malicious. When the file was shared via a link in a new Gmail message, Gmail did not rescan it and applied the "Scanned by Gmail" label.

The researcher said this occurs because Gmail grants implicit trust to files originating from Google Drive within its ecosystem. As a result, standard verification steps are bypassed. The malicious payload inherits the safe status of its storage container.

Ilkashi also identified a separate issue involving files labeled "Blocked for security reasons" by Gmail rather than identified as viruses. When such a file is uploaded to Google Drive and not flagged for abuse, attaching its share link in Gmail presents it with the "Scanned by Gmail" label and no warning.

Users could download the file directly from Gmail's endpoint or file preview without any warning page or popup. Accessing the same file directly through Drive did display the expected warning. Ilkashi said this represents a flaw in the implementation of the Google Drive file download mechanism within Gmail's endpoint.