The latest flaw, found on the search engine's server, allows hackers to take the user to a Google URL and steal their cookie data according to Philipp Lenssen, author of the Google Blogoscoped blog.
This information allows the malicious user to access and modify the user's documents and spreadsheets, view email subjects and search history, Lenssen said.
"It starts to show that Google, by integrating more and more services onto its website, all able to share the same account login, is also exposing its users to growing risks," Lenssen said in his blog.
The vulnerability is similar to one discovered by security researchers last week. Using a proof-of-concept script to target the flaw, the white hat was again able to obtain the user's Google cookies.
The web giant has now provided patches for all three flaws.
Google cross-site scripting vulnerability found, patched
By Fiona Raisbeck on Jan 18, 2007 7:01AM