There is no XSS here, and no cookie tossing. Google opens translated pages under translate.googleusercontent.com. Link is located on GUC Page 1 (now, perhaps,

There is no XSS here, and no cookie tossing. Google opens translated pages under translate.googleusercontent.com. Link is located on GUC Page 1 (now, perhaps, you can see iframe, but it's trivial to add some CSS to make it look more seamless). It opens with window.open this URL: http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fkremlin.ru%2F http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=ht... Now GUC Page 1 changes content of GUC Page 2 (translated page of kremlin.com). Using some DOM and frame tricks I ranted a bit about in the post.