Ethical Hacker "Vansh sharma" and his brother(Vaibhuv sharma) found a reflected XSS vulnerability in Google apps site.
Just go to https://www.google.com/a/
On the right side click on FIND DOMAIN
and in the text box enter this script <img src="<img src=search"/onerror=alert("
and click CHECK AVAILABILITY and it will pop-up.
They have informed to google about the vulnerability.