CVE-2026-85268
Received Received - Intake

Cross-Site Scripting in Google Cloud Identity Platform iOS

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GoogleCloud

Description
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-85268
EUVD
EUVD-2026-113761

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Google Cloud Identity Platform and Firebase Authentication 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Google Cloud Identity Platform and Firebase Authentication for iOS. It allows an unauthenticated remote attacker to execute arbitrary JavaScript by exploiting a malicious iOS bundle ID. The vulnerability exists in the auth/handler component and affects versions prior to 2026-08-14.

Impact Analysis

An attacker could inject and execute malicious JavaScript in the context of an affected application. This may lead to theft of user sessions, sensitive data exposure, or unauthorized actions performed on behalf of users. The impact depends on the application's functionality and data handling.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if user data is compromised.

Mitigation Strategies

Update Google Cloud Identity Platform and Firebase Authentication to versions released on or after 2026-08-14 for iOS to address the XSS vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart