Spoofing Sender with Google Quick Email

There are more and more widgets on the Google homepage. One of them is called Quick Email. After adding it, you can quickly write and send emails.

It was found that this QuickEmail does not require entering the password for the email account. If someone dishonestly sets their email to another person's email name, they could potentially forge emails! Upon checking the original email, it can be discovered that the source host is web4.myhsphere.biz.