Security researchers hack Google’s Chrome OS

From the outline presented here, it sounds like generic web vulnerabilities, rather than something ChromeOS-specific. But with content like "hackers could have a field day accessing data on Chromebooks. [...] With Chromebooks, no data is stored on the device" it's hard to tell.

eweek has a slightly better write-up:

http://www.eweek.com/c/a/Mobile-and-Wireless/Google-Chrome-O...

In his demonstration, a friend shared a folder containing a note with malicious code, which was then accessible on the CR-48 through the ScratchPad extension. Once the note was opened, the note was able to then steal all his contacts saved in Gmail because he was already logged into Google's services.

Sounds like poorly-filtered ScratchPad notes (which presumably aren't supposed to contain executable code) combined with xss or csrf.

EDIT: Does ChromeOS give apps access to all cookies for all sites?

The security flaw is that it accesses the internet.