Google Blogoscoped forums mention a blacklist and whitelist discovered by contributors - apparently used to popup malware warnings.

Funnily enough, Google references their own pages in the blacklist in order to trigger the malware warnings in their examples. Ex:

+http://www.google.com/tools/firefox/toolbar/FT2/intl/en/phish-o-rama.html