> relies on the creator clicking the link and that's why google calls it social engineering. But i still do believe this is a vulnerability. It catches people

> relies on the creator clicking the link and that's why google calls it social engineering. But i still do believe this is a vulnerability. It catches people offguard, and makes social engineering easier. An attacker controlled link in a place that a user would not expect to be vulnerable (as it is in a "trusted" environment).