Maxdamantus on IRC has submitted (or will submit) a security report to Google describing the details and hopefully Google can sort it out.