Google cross-site scripting vulnerability found, patched

The latest flaw, found on the search engine's server, allows hackers to take the user to a Google URL and steal their cookie data according to Philipp Lenssen, author of the Google Blogoscoped blog.

This information allows the malicious user to access and modify the user's documents and spreadsheets, view email subjects and search history, Lenssen said.

"It starts to show that Google, by integrating more and more services onto its website, all able to share the same account login, is also exposing its users to growing risks," Lenssen said in his blog.

The vulnerability is similar to one discovered by security researchers last week. Using a proof-of-concept script to target the flaw, the white hat was again able to obtain the user's Google cookies.

Earlier this month, a cross-site request forgery vulnerability that could allow a hacker to steal a Gmail user's contact list was exposed by Haochi Chen, author of the Googlified blog. The 16-year-old posted proof-of-concept code that steals the details in JavaScript files.

The web giant has now provided patches for all three flaws.

crosssitefoundgooglepatchedscriptingsecurityvulnerability