Online attackers can gain access to the Google Desktop application through a cross site scripting attack, researchers at Watchfire have discovered.

We've seen cross site scripting vulnerabilities before, but this one is amazingly easy to demonstrate on your home or office computer, provided that you are running Google Desktop and haven't just updated it.

Curious? Go to your Google Desktop search page and type in the following:

22 Feb 2007

under:<script>alert(This is all it takes)</script>

Once you enter that instruction, an alert box will pop up with the text "This is all it takes" inside. Displaying an alert box might not be anything serious, but that attacker can also insert more harmful commands that can expose confidential information, or worse.

Now go to Google and download the latest Google Desktop update.