Google's login page accepts a vulnerable GET parameter
Steps:<p><pre><code>    1. Send email that looks
       like it&#x27;s from AdWords,
       claiming the user&#x27;s CC
       needs to be updated

    2. User logs into Google
       after verifying URL is
       in fact google.com

    3. Google literally sends
       trusting user to attack
       site... to enter their
       credit card number
</code></pre>
How is this not a serious vulnerability?