CVE-2026-85268: Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Developers who followed Firebase redirect best-practices Option 4 (self-hosting the helper code) should re-synchronize the hosted helper code to obtain the latest version.
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS in versions prior to 2026-08-14. The provided information does not identify any additional platform scope.
Does exploitation require an authenticated account or user interaction?
An attacker does not need to be authenticated, and exploitation is remote with low attack complexity. User interaction is required according to the supplied severity vector.
What attacker-controlled input is involved?
Exploitation uses a malicious iOS bundle ID to trigger cross-site scripting in the auth/handler, allowing execution of arbitrary JavaScript.