[gruez]

Can someone screenshot the page? I'm getting "permission denied" followed by a redirect to google sign in.

[nexuist]

I'm guessing this was quickly hidden by Google staff based on its severity? Unless this was released following responsible disclosure practices, in which case I don't know what I'm talking about.

[kowdermeister]

Or it was that kind of bug report where the reporter made a normal thing sound dangerous. I remember one case when someone suggested that JS should be turned off by default because "arbitrary code execution" :)

Edit: with chrome extensions, I can inject a script tag from any domain to any page. I used that to inject a lib from CDN JS, but recognized it's silly and imported the package instead.

[domnomnom]

But wait that’s actually a good point

[bigiain]

Not me.

But I suspect it's related to this:

https://twitter.com/gorhill/status/1151979007052845056

[nitrohorse]

Yeah, looks like the report is hidden now. Unfortunately it wasn't captured in the wayback machine.

[sam1r]

What happens to those that are still curious? One may ask.

[edoceo]

We wait for a post-mortem