“And there we go, a one-click clickjacking attack that chains a Google Slides YouTube embed path traversal to three separate redirects to gain editor access on a Drive file/folder!”
Google Slides built the YouTube embed URL from a video ID it never checked, so “../” walked out of /embed/ and into the rest of youtube.com. From there two redirects Google trusted landed on a Drive share dialog that filled in the attacker’s email and defaulted to Editor. One click on “Send” gave away the folder. Google paid $4,133.70 for a chain made entirely of its own “harmless” redirects.