ZeroSSL: XSS leading to session hijacking, stealing a private key (and a password hash)
groups.google.com