White-hat hacker Oren Hafif found the security hole, which has now been fixed by Google. Hafif will receive a bug bounty under the Google Vulnerability Reward Program for his trouble, and a place in the companys Hall of Fame. The hacker is able to grab information about what you enter as your new password, and cookie information related to your account. Google has fixed the problem 10 days after Hafif informed Google of the problem, and Hafif is given a place on Google Plus.”]
Source: https://grahamcluley.com/security-hole-gmail-password-recovery-system/