Can you link to more details? If this is true then it should be flagged and fixed.
Oh, it was. But only after I asked a Google employee via social media if he could flag it to get it fixed (which actually did help).
It’s a bit suboptimal when the only real way to fix issues is via HN or similar sites.
I’ve seen it before, reported a vulnerability to Google, got a "not a vulnerability, not eligible for anything" back, published the PoC on my website, and Google subsequently blacklisted my domain, IP range, and everything.