>Google some things from googleusercontent.com, Reddit delivers some things from redditmedia.com and so on.

Exactly:

>If you are injecting script in subdomains of (sandbox) domains such as: [...] ...we won't file a bug based on your report, unless you can come up with an attack scenario where the injected code gains access to sensitive user data.

https://bughunters.google.com/learn/invalid-reports/web-plat...

e.g.

https://www-tutorialrepublic-com.translate.goog/codelab.php?...