Another Google cross-site scripting flaw is found

Another Google cross-site scripting vulnerability has been discovered by security researchers in one of its web-hosting services, the third such problem identified in the past few weeks.

The latest flaw, found on the search engine's server, allowed hackers to take the user to a Google.com URL and steal their cookie data, according to Philipp Lenssen, author of the Google Blogoscoped blog.

This information then allowed the malicious user to access and modify the user's documents and spreadsheets, view email subjects and search history, he said.

"It starts to show that Google, by integrating more and more services onto its website, all able to share the same account login, is also exposing its users to growing risks," Lenssen said in his blog.

The vulnerability is similar to one discovered by security researchers last week. Using a proof-of-concept script to target the flaw, the white hat was again able to obtain the user's Google cookies.

Earlier this month a cross-site request forgery vulnerability that could allow a hacker to steal a Gmail user's contact list was exposed by Haochi Chen, author of the Googlified blog. The 16-year-old posted the proof-of-concept code which takes the details in JavaScript files.

The web giant has now provided patches for all three flaws.

Google UK did not return requests for comment.

Sign up to our newsletters