Security researchers have discovered a serious flaw in Google's desktop software that could be used to wreak havoc on a victim's computer.
The bug, which was made public Wednesday by web application security firm, Watchfire has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here [http://desktop.google.com/]. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt, via e-mail.
Google was first notified of the problem on 4 January and produced its fix on 1 February, a Watchfire spokesman said.
In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited," he added.
Watchfire's research underscores the danger of integrating Web-based applications with the desktop, the company said in a white paper, published Wednesday.
For this attack to work, the criminal would have to first go through a number of steps, including hacking Google.com to find a cross-site scripting vulnerability on the website – something that has been done several times in the past year, according to Watchfire.
If successful, however, the attack would be devastating. A criminal could search for anything on the computer or even take over the victim's computer by tricking Google desktop into running malicious software stored on another computer, Watchfire claims.