Google Gadgets are little programs that gather information on the Web and then display them on multiple Web pages, making it easy for Webmasters to display everything from sports scores to astronomical data across their sites. The domain used to host small Google Gadget applications written by Web developers could be misused by phishers to get around antiphishing filters. Attackers could create a phishing site on the gmodules.com domain and then send that URL to victims. Because Google"s gmodules.com domain is trusted by antiphishing filters, victims are not warned by their browser"s filtering software.
Security researcher Robert Hansen, CEO of SecTheory and a frequent critic of Google, reported the issue to the company"s security team, but he was not satisfied with their response. He says Google told him that what he sees as a flaw is simply part of the site"s expected behavior. Hansen insists Google should restrict the URLs that can use this domain to avoid helping online criminals.