Vulnerability · Published Oct 20, 2026 · Assigned by GoogleCloud

CVE-2026-85267Cross-Site WebSocket Hijacking in Google Cloud Shell

High 8.7

In plain English

A high-severity security flaw in Cloud Shell from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

Affected products (as reported)

Vendor	Product	Versions
Google Cloud	Cloud Shell	0 – before 2026-07-22

Weakness: CWE-1385 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear

References

https://docs.cloud.google.com/shell/docs/release-notes#July_28_2026