Reports are being made that the Google Toolbar has an exploit that can allow the execution of unauthorised scripts via the toolbar itself:

http://www.securitytracker.com/alerts/2004/Sep/1011351.html
http://www.securityfocus.com/bid/11210

Yes but, this can only be accomplished via the local zone -- and not from a remote location such as a malicious website. A person must first gain access to your machine. I can think of a lot more things to do to a machine that I have access to than exploiting ones Googlebar. :D

I can think of a lot more things to do to a machine that I have access to than exploiting ones Googlebar.

Absolutely! Once someone gets this far you are busted - toolbar or no toolbar! :)

Update to this vulnerability in this thread (http://forums.searchenginewatch.com/showthread.php?t=1836).