CVE-2026-85267: Cross-Site WebSocket Hijacking in Google Cloud Shell
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.
This vulnerability was patched on 22 July 2026, and no customer action is needed.
Affected Software
Event History
Frequently Asked Questions
Who could be affected by this issue?
Users with an active Google Cloud Shell session before the 22 July 2026 patch were potentially exposed. An unauthenticated attacker could hijack such a session and exfiltrate the user's OAuth access token.
What attacker access or conditions were required?
The issue could be exploited by an unauthenticated attacker through a cross-origin WebSocket request. The affected user needed to have an active Cloud Shell session.
Do customers need to take remediation steps?
No customer action is needed. Google patched the vulnerability on 22 July 2026.