8.7 High

CVE-2026-85268 A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase…

Description

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

Affected products and versions

Product	Affected versions	Fixed in
Identity Platform and Firebase Authentication 2026	earliest → < 2026-08-14	2026-08-14

Do you use Identity Platform and Firebase Authentication?

Track this CVE Watch Identity Platform and Firebase Authentication Check my SBOMs

www.cveye.io/en/cve/CVE-2026-85268

Timeline

Published October 30, 2026
Last modified October 30, 2026

References

firebase.google.com firebase.google.com

Track this CVE