Yet another Gmail vulnerability squished by Google

Posted by multippt

Google has patched up a vulnerability (due to a CSRF [cross site request forgery]) (within hours after it was reported) that would allow a malicious JavaScript (!) script to display the visitor (of the site with the malicious script) his or her Gmail contacts if he or she were still logged into their accounts. It is a little worrying that this bug existed since day 1, and it is even more worrying if you had confidential information within the contact list.

Google sure deserves credit for patching this vulnerability quickly on New Year’s day.