It's with the toolbar itself. If you copy the code and save it as an html file then open the html file you will see the vulnerability. I did not discover this flaw. Since this is a newly discovered issue I am not sure the full extent of the damage that could be caused. The code provided will only do a javascript alert window to prove concept. It affects Google Toolbar 1.1.41 through Google Toolbar 2.0.114 .1 versions.
This is an issue that was recently discovered on September 17 and being discussed at a corporate security briefing I was attending due to some security alerts I received.
I meant to post some links that confirms this.
http://www.securityfocus.com/bid/11210
http://www.securitytracker.com/alert...p/1011351.html
imaginemn