8.7
Élevée
CVE-2026-85267 A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an…
Description
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cloud Shell 2026 | premières → < 2026-07-22 | 2026-07-22 |
Références
- docs.cloud.google.com docs.cloud.google.com
Chronologie
- Publiée
- Dernière modification