GMail and Google Groups are vulnerable to an cross site scripting (XSS) attack due to their reliance on Content-Disposition to provide separation between the HTML file download and application scopes.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45441/ggg-XSS
Source: https://packetstormsecurity.com/files/45441/ggg-XSS.html