Comment by angry-hacker

Can someone explain me:

If angular can do it, so can just plain javascript? Then it's a problem with their extension architecture?

As much as I hate bundling big libraries everywhere, why ban angular?

Also, is it possible the researcher wants to get money from Google and didn't want the vulnerability to be shared?