Two security researchers have posted information about Google security vulnerabilities linked to cross-domain Web application sharing that could put users at risk, according to eWEEK.

Security researcher Aviv Raff has provided details about a cross-domain Web application sharing flaw that affects several Google applications, including Gmail, Google Maps, Google News and Google search. Raff says he told Google about the vulnerability that could allow Google accounts to be hijacked, but has received no word on a fix.

Meanwhile, researcher Adrian Pastor has posted proof-of-concept code that shows how attackers can inject their own pages that still seem to show the Google domain in the address bar. This flaw could trick users into entering log-in information, notes InformationWeek.

Google says it is investigating Raff's information and is aware of the potential for the frame injection attack demonstrated by Pastor.