A security flaw has been discovered in Google's Toolbar which could allow criminals to steal data or install malicious software onto people's computers. The flaw works by exploiting the toolbar's ability to install new buttons, and allows a hacker to potentially disguise malicious code as a legitimate button due to the fact that the toolbar does not perform adequate checks when buttons are being installed. To become a victim of the vulnerability, a user would have to be tricked into clicking a link which would open a new popup window asking them to install a custom button, which appears to be installed from a legitimate site such as Google. It then needs to be run from the toolbar, and a user would have to agree to downloading and running an executable. Given the number of steps involved, the flaw is not being treated as critical, and Google is already working on a fix for the problem.