Google has patched a cross-site request forgery vulnerability in Gmail that could allow the forwarding of messages to a malicious user.