8.7 High

CVE-2026-85267 A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an…

Description

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

Affected products and versions

Product	Affected versions	Fixed in
Cloud Shell 2026	earliest → < 2026-07-22	2026-07-22

Do you use Cloud Shell?

Track this CVE Watch Cloud Shell Check my SBOMs

www.cveye.io/en/cve/CVE-2026-85267

Timeline

Published October 20, 2026
Last modified October 20, 2026

References

docs.cloud.google.com docs.cloud.google.com

Track this CVE