[reginaldo]

I recently found a pretty simple one on https://accounts.google.com/, which is arguably Google's most valued domain. I believe XSS is the most common vulnerability these days. One doesn't even have to be able to inject javascript per se. Only a CSS style is enough in many cases.

[TomAnthony]

The bounty for that page is ~$10k or such, no? Did you get anything?

[reginaldo]

Actually it is $3133.7 (eleet). I got it, of course. The security team at Google is, simply put, awesome.