Administrator account takeover via reflected script execution

Reflected XSS in Google Cloud Looker allows remote attackers to execute script in an administrator's session through a crafted URL. Google has not disclosed the affected request parameter or the operation that places attacker-controlled URL data into an executable browser context. Exploitation requires an authenticated administrator to open the URL; the resulting script runs on that administrator's behalf and enables account takeover.