[Osiris]

Firefox users: Beware of Gmail XSS Attack

An exploit for Firefox, reported 10 days ago and as of yet still not patched, is giving attackers access to Google accounts, including gmail.
Firefox users are advised to use NoScript or turn off javacript on unknown webpages and stay logged out of their Google Accounts until a fix is issued.

A 302 redirect error in Google, discovered by bedford.org's Morgan Lowtech aka tx, creates a domain-wide cross-site scripting attack allowing hackers to gain access and modify Google user accounts including e-mails, contact lists and online presence.

[Trotter]

Thanks for the heads up. NoScript should be a part of everyone's extension library.

[Nick]

just when i was thinking how reliable firefox was

[Trotter]

It still is, Nick. People are constantly looking for chinks in everything's armor. the good part is that it is known and there is a way to address it until it is officially sealed.

Javascript can do some amazing stuff, but it can also be used maliciously as we have seen here.