The flaw was spotted by independent security researcher Yan Zhu at the end of October. Zhu found that an attacker could send an email using a different name, and conceal their real email address. The bug only worked within the Gmail Android app, but opened the door for dangerous phishing attempts, given that anyone could pretend to be anybody else, and get away with it.

Read More at www.motherboard.vice.com