A security researcher has discovered an interesting vulnerability in the Gmail app for Android devices that allows anyone to send emails that appear to have been sent by someone else. 
This behavior is used by Phishers to mislead their victims. It is called E-mail Spoofing and usually involves forging an email header to make it appear to come from someone else.
Independent security researcher Yan Zhu discovered the flaw in the official Gmail app for Android devices.
The bug allowed her to hide her real address and change her display name from her account settings, so the recipient could not know the real sender.
How to Send Spoofing Emails via Gmail for Android?
To prove her point, Zhu sent an email to someone, changing her screen name by adding extra quotes “”security@google.com.” You can see the screenshot posted by Zhu on Twitter below.
“The extra quotes [in the display name] cause a parsing error in the Gmail app, which makes the actual email invisible,” Zhu told Motherboard.
Google: “Bug is not a security vulnerability”
Zhu reported the flaw to Google's security team in late October, but the team dismissed her report, saying the bug was not a security vulnerability.
“Thank you for your note, we do not consider the bug a security vulnerability,” a member of Google’s security team told Zhu.
“A Gmail bug on Android that allows you to send email with a fake address is not a security issue for Google. ¯ \ _ (ツ) _ / ¯,” Zhu wrote.
filed a gmail android bug that lets me fake sender email address. they said it's not a security issue. ¯_(ツ)_/¯
— yan (@bcrypt) November 11, 2015
And the image published by the researcher:
