For as long as I can remember (which appears to be about 2.5 years), Jim Ley has been complaining to anyone who'd listen (which didn't include Google's security team) about script insertion flaws in Google's Javascript code.

Earlier this week Jim took the nuclear approach and released a working example of the exploit that looked like a classic phishing scam. Google finally noticed and took some action.

However, they don't appear to have done a great job in fixing the holes, as Jim's still seeing the exploit working, and Paul Mutton of Netcraft has discovered (and reported to Google) a number of other possible exploits. Google's a great search engine, but they really should have sorted this out faster and better.