CVE-2026-85267
Cross-Site WebSocket Hijacking in Google Cloud Shell
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.
| CWE | CWE-1385 |
| Vendor | google cloud |
| Product | cloud shell |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for google cloud cloud shell
Be the first to know when new unknown vulnerabilities affecting google cloud cloud shell are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Google Cloud / Cloud Shell
0 < 2026-07-22
References
Credits
🔍 Elad Beber