{"id":"CVE-2026-85267","published":"2026-10-20T10:17:07.007","lastModified":"2026-10-20T19:18:51.900","description":"A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.\n\n\nThis vulnerability was patched on 22 July 2026, and no customer action is needed.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1385"],"vendors":[],"products":[],"references":[{"url":"https://docs.cloud.google.com/shell/docs/release-notes#July_28_2026","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}