Using YouTube in Google Slides to Steal Files

A security researcher wrote up a great blog post about discovering a way to use embedded YouTube videos in Google Slides to craft an attack that could trick someone into granting access to their Google Drive files.

This is a great read as it details the journey they went through from initial theory to successful execution. They reported it to Google and received a bug bounty award. Another cool thing about this post is that all the imagery isn’t actually images—the author used HTML and CSS to reconstruct the examples, which was pretty neat.