The flaw which was discovered by Nir Goldshlagger and was tested many times. hey this is Cross site Scripting In Froogle And its leads to steal the cookie in gmail if you send this link to the Victim in gmail email: <> when he click this link you steal is cookie in gmail And Even if the victim does change his password afterwards, it will be to no avail. "The system authenticates the hacker as the victim, using the stolen cookie file. Thus no password is involved in the authentication process. The victim can change his password as many times as he want, and it still won't stop the hacker from using his box", and even if the victim dosent save his cookie in gmail when he click this cross site scripting link in his gmail account its still steal his cookie And if He Save His Cookie in gmail you can send this Cross site scripting in any way you want to the victim and its will steal his cookie Proof Of Concept By Nir Goldshlager: <> Proof OF Concept By Nir Goldshlager 2:<> This Flaw Was Discovered By Nir Goldshlager goldshlager@gmail.com > Thanks