Cross-Site Scripting Vulnerability in Google Cloud Identity Platform and Firebase Authentication
CVE-2026-85268

8.7HIGH

Key Information:

Vendor

Google Cloud

Status
Identity Platform And Firebase Authentication
Vendor
CVE Published:
30 October 2026

What is CVE-2026-85268?

A Cross-Site Scripting (XSS) vulnerability in the authentication handler of Google Cloud Identity Platform and Firebase Authentication for iOS may allow unauthenticated remote attackers to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. This flaw raises serious security concerns as it could lead to compromised user data and unauthorized actions within affected applications.

Affected Version(s)

Identity Platform and Firebase Authentication iOS 0 < 2026-08-14

References

https://firebase.google.com/support/releases#auth-helper-fix

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mathias Karlsson
.