Read the docs
TI-2026-76767 Aliases CVE-2026-85267GHSA-342c-3cqc-4gph

Cross-site WebSocket hijacking in Google Cloud Shell

Priority LOW 39CWE-1385Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Google Cloud Shell on Google Cloud Platform is affected before 2026-07-22. Missing origin validation in WebSockets (CWE-1385) lets a cross-origin WebSocket request reach an active Cloud Shell session. An unauthenticated attacker can hijack that session and exfiltrate the user's OAuth access token.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed Cloud Shell (Google Cloud): 2026-07-22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleCloud Shellbefore 2026-07-222026-07-22Patch availableCNA
  • Cloud Shell VendorGoogle Affected before 2026-07-22 Fixed in 2026-07-22 Patch available CNA

Remediation

Google fixed Cloud Shell in 2026-07-22, and no customer action is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Cloud Shell (Google Cloud) Fixed in 2026-07-22

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-85267
  2. 2026-10-20 Alias added: GHSA-342c-3cqc-4gph
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences