Google still allows users to be fully logged out of their Google Account just by opening a specific URL, such as https://accounts.google.com/Logout This instantly signs users out of Gmail, YouTube, Drive, and also pauses Chrome Sync without warning.

Because this logout uses a simple GET request, it can be triggered through hidden redirects, shortened links, popups, or embedded images. This makes it easy to misuse in scare-tactic pages, fake support scams, or prank links that force people to think something is wrong with their account.

Logging someone out should not be something that any random website can trigger with no confirmation. Many modern services require logout actions to use POST requests, confirmation prompts, or CSRF protection to prevent exactly this type of issue.

We ask Google to update its logout system so users cannot be forcibly logged out through redirects or disguised links. A confirmation step or a safer logout method would prevent confusion, reduce scam potential, and protect less tech-savvy users.

My father was tricked into calling a scammer after being logged out of his Google account via a hidden URL embed. This manipulation led him to believe his computer was compromised, causing unnecessary distress and potential financial harm.

This personal experience highlights a significant vulnerability in the way Google handles account logouts. The ease with which malicious actors can exploit this to deploy scare tactics and manipulate unsuspecting users is alarming and needs immediate attention.

Every day, individuals fall victim to similar scams, with a notable increase in such attacks in recent years. According to a report by the Federal Trade Commission, consumer losses due to imposter scams exceeded $2 billion in 2021 alone. A substantial portion of these scams involve deceptive practices like forced logouts.

Google should make logging out secure, intentional, and resistant to abuse.