I emailed [email protected], but I figured that posting it here would make it more likely for them to fix it faster.

Noble intentions but please don't do this in the future. Working in security (not at google) I promise we are trying to fix it as fast as possible already :)

You may also get cash+prizes if you submit as you did but don't release it publicly.

Yeah, because you don't understand responsible disclosure. Contact security teams first before going public with a problem.