A SQL injection vulnerability (CVE-2025-12409) was discovered in Looker Studio that allowed attackers to exfiltrate data from BigQuery data sources by creating malicious reports with native functions enabled. The vulnerability enabled execution of injected SQL queries with the victim's BigQuery permissions when the victim accessed the malicious report. This issue was patched on July 7, 2025, and no customer action is required.