Cross-Site Scripting Vulnerability in Google Cloud Looker
CVE-2026-15810

8.7HIGH

Key Information:

Vendor

Google Cloud

Status
Looker
Vendor
CVE Published:
24 July 2026

What is CVE-2026-15810?

A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker allows attackers to inject and execute arbitrary JavaScript code. This flaw affects both Looker-hosted and Self-hosted versions, leading to potential administrative account takeover through malicious URLs. While Looker-hosted instances have been mitigated automatically, users of Self-hosted versions are urged to upgrade to specific patched versions to secure their installations.

Affected Version(s)

Looker Looker-hosted 0 < 25.6.103

Looker Looker-hosted 0 < 25.12.65

Looker Looker-hosted 0 < 25.18.68

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-049
https://docs.cloud.google.com/looker/docs/release-notes#J...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sivanesh Ashok
Sreeram KL
.