/>
X

Google patches XSS security flaw

The search giant has fixed a second flaw in its software in as many days
tom-espiner.jpg
Written by Tom Espiner, Senior Reporter on

Google has patched a cross-site scripting (XSS) vulnerability in one of its web-hosting services.

If left unpatched, the vulnerability could have allowed hackers to modify third-party Google documents and spreadsheets, and view mail subjects and search history, according to the Google Blogoscoped blog.

Philipp Lenssen, the author of Google Blogoscoped, a third-party site that comments on Google developments, said the vulnerability was similar to another vulnerability in Blogger Custom Domains reported on Sunday night.

"The security hole is connected to an update to a specific Google service which doesn't correctly defend against HTML injections," he said.

According to Lenssen, the earlier Custom Domains vulnerability allowed another Google expert, Tony Ruscoe, to create a page that was hosted on a google.com domain. Ruscoe was able to prove that he could have used code to steal a user's Google cookie and access their Google services.

The second vulnerability, reported by Lensson, would also have enabled a hacker to use JavaScript code to pass cookie data to an external source.

Google UK had not responded to a request for comment at the time of writing.

Related

Why you need an Android smartphone with a thermal and IR camera
img-6767

Why you need an Android smartphone with a thermal and IR camera

Android
Tech jobs: These are the 10 most in-demand developer, cybersecurity and cloud roles
two male and one female colleagues stood over a desk looking at a computer screen and discussing a project cheerfully

Tech jobs: These are the 10 most in-demand developer, cybersecurity and cloud roles

Developer
Remote work or hybrid? Why employers have changed their minds
Woman discussing work on video call with team members at office

Remote work or hybrid? Why employers have changed their minds

Professional Development