data:text/javascript,alert('foo')

Thank you sir! I learned something new today =)

Thank you!

Just add a foo.js file to any of your GitHub repos, grab its raw URL and pass it through rawgit.com.

//dl.dropboxusercontent.com/u/18177522/google_xss_game/alert.js

You don't need to:

data:text/javascript;base64,YWxlcnQoMTMzNyk=

They provided a hosted callback in the clues. Just change foo to alert.

The callback in the hints didn't work for me in the game, but the other suggestions here are working and quite eye opening ...

That this works is really scary if not fully surprising: data:text/javascript;base64,YWxlcnQoMTMzNyk=

Thanks jehna1 , sebslomski , all!

it works, you just gotta use it like google.com/jsapi?callback=alert