I'm pretty surprised that Google was allowing such blatantly obvious XSS attack vectors.