Weve seen some speculation recently about a purported security vulnerability in Gmail and the theft of several website owners domains by unauthorized third parties. At Google were committed to providing secure products, and we mounted an immediate investigation. Our results indicate no evidence of a Gmail vulnerability.

With help from affected users, we determined that the cause was a phishing scheme

Google continues to write, Several news stories referenced a domain theft from December 2007 that was incorrectly linked to a Gmail CSRF vulnerability. We did have a Gmail CSRF bug reported to us in September 2007 that we fixed worldwide within 24 hours of private disclosure of the bug details. I contacted Brandon at GeekCondition yesterday to find out more but havent heard back from him yet.

Included links: Google Blog, GeekCondition

Del.icio.us

Digg

Reddit

Furl