The Embedded YouTube Player Told Me What You Were Watching (and more)
There was a bug in the embedded YouTube player that allowed hackers to view anyone's YouTube watch history, the links to their unlisted videos, their Watch Later playlist, the list of videos they've liked, and more. YouTube creates internal playlists for all users, which can be accessed by replacing some characters in the URL. You can't just view other people's private videos just with this knowledge, but the embedded player had a bug that could be exploited to do so. The bug was reported, but Google's response showed that they might not have seen the severity of the issue. It has now been fixed.