CVE-2026-85267 — Cross-Site WebSocket Hijacking in Google Cloud Shell

CVE-2026-85267

Cross-Site WebSocket Hijacking in Google Cloud Shell PUBLISHED

Description (CNA)

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

Affected (CNA)

Vendor / product	Versions
Google Cloud / Cloud Shell	affected 0 before 2026-07-22

CWE

CWE-1385

References

https://docs.cloud.google.com/shell/docs/release-notes#July_28_2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.