PT-2026-118320
CVE-2026-85267
·
Published
2026-10-20
·
Updated
2026-10-22
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Name of the Vulnerable Software and Affected Versions
Cloud Shell versions prior to 2026-07-22
Description
A Cross-Site WebSocket Hijacking flaw allows an unauthenticated attacker to hijack an active session and exfiltrate the user's OAuth access token. This is achieved through a cross-origin WebSocket request, potentially exposing tokens with cloud-platform and Drive scopes. The attack can be executed remotely with a single click or with zero clicks if the attacker is on the same network.
Recommendations
No customer action is needed as the issue was patched on 22 July 2026.
Found an issue in the description? Have something to add? Feel free to write us 👾