[rwth-security] Exploiting CSP Wildcards for Google Domains