Disguised as a security check, this fake Google alert uses browser permissions to harvest contacts, location data, and more.