Whoopsies. It appears that the popular "Avast! Mobile Security" -- it's got somewhere between 10 million and 50 million downloads from Google Play -- is marking Android's Gmail as malware. You might get a lot of spam and other unwanted e-mail, but that doesn't quite make gmail itself a malware app. This, folks, is what you call a false positive.

More: Android Malware scanners - should you use one?

Users of Avast are reporting other false positives as well, including WhatsApp, Amazon, ScoreCetner, Redbox, PayPal, Google Currents, YPMobile, HP ePrint, Rdio, Linked In, Foscam Remote and others. 

The good news is you can white list it with the app. Also, Avast apparently is aware of the mix-up and has a new set of virus definitions on the way. Support forum moderator Filip Havlicek writes:

it seems that this false positive detection somehow got through our systems to everyone. I'm sorry for that. Don't worry though, there should be a virus definitions update soon that will remove this detection. I'm going to reroute all topics to this one and lock them so everyone knows what's happening. I'll post here when the update is out so everyone can do a manual update of their definitions to fix this (or you can, of course, wait for the automatic update to happen, but manual will most probably be faster in this case).

So, yeah. False positive. Let's hope Avast didn't miss anything that actually is malware.

Source: Avast support forums
Thanks, @xalasten and @walnuts315!