[ CVE-2026-85268 · Published 30 Oct 2026 ]
Vulnerability in Google Cloud Identity Platform and Firebase Authentication
CVSS 8.7
EPSS <1%No fix listed yet
[ Description ]Official description
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.