Originally Posted by Security Dump

source:http://www.securitydump.com/content142.html

A recently discovered vulnerability in Google Gmail allows automatic javascript execution when using the preview function.

While Google filters javascript sent among Gmail accounts, e-mail from outside accounts such as Yahoo! are not filtered.

Normally Gmail would quote the javascript code, however if one includes a short amount of text in the subject and body of the message, then Gmail instead executes the code.

This vulnerability could be used to gather email addresses or compromise viewers Gmail account.