Any referred domain had full access to the referring domain (even across multiple redirects). This means badsite.example can have access to your Google account

Any referred domain had full access to the referring domain (even across multiple redirects). This means badsite.example can have access to your Google account just from clicking on a Google search result. I made an exploit that worked on Twitter and Reddit to retweet/upvote/etc.