Google Docs XSS – no bounty today

The blog details a ZIP filename-based XSS vulnerability in Google Docs/googleusercontent: by placing a harmless filename in the ZIP local file header and a malicious HTML payload in the central directory entry, Google displays unsanitized content from the archive, enabling phishing or session-theft attacks; the issue was reported to Google, which deemed the googleusercontent.com domain a sandbox and did not issue a bounty.