It wasn't quite that simple ;-)

http://www.reddit.com/r/programming/comments/cluc5/html_inje...

The payload in the case of YouTube was only slightly more complex (two <script> tags instead of one), but it sounds like the underlying cause was very different.

---

Many websites and web applications are vulnerable to XSS in one form or another. The difference here, as people have pointed out, is the trust placed in the site by Android. It's not very often that an XSS vulnerability can execute arbitrary code on a remote system. :-P