I'm guessing this was quickly hidden by Google staff based on its severity? Unless this was released following responsible disclosure practices, in which case I don't know what I'm talking about.
Edit: with chrome extensions, I can inject a script tag from any domain to any page. I used that to inject a lib from CDN JS, but recognized it's silly and imported the package instead.