Its too bad (in a way...) they couldn't get private video IDs to leak. It would have made an impressive combination with their bug posted earlier this month (Stealing Your Private Youtube Videos, One Frame at a Time <a href="https://news.ycombinator.com/item?id=25728175" rel="nofollow">https://news.ycombinator.com/item?id=25728175</a>)<p>Speaking of... do security researchers sometimes just sit on their discoveries in hopes that they will eventually lead to a bigger payout? I would be kicking myself if I had reported a bug for a relatively small reward that I could have leveraged in combination with another discovery
Yet another example of why the whole concept of third-party cookies does much more evil than good. Yet all major browsers keep them enabled by default.
I honestly feel like Google's award in this case is pathetic. This is an exploit which would be worth 100s of thousands, if not millions to the wrong people.
I can see why Google might want to downplay this. Partner websites could obtain the history info directly from users and Google would not need to disclose the data sharing. I'm sure the watchlists/history would be valuable tools for profiling and advertising purposes.
This is a bad link, not sure how it got upvoted when following it fails (there’s a trailing . after the domain). That’s kinda fishy...<p>Correct link should be <a href="https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-youtube-player-told-me-what-you-were-watching-and-more/" rel="nofollow">https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-yout...</a>