Live › vulnerability › CVE-2026-85268
Google Cloud Identity Platform and Firebase Authentication's auth handler on iOS does not safely handle a malicious iOS bundle ID, so an attacker can inject and run arbitrary JavaScript in a victim's browser. The flaw is reachable without an account, per the NVD description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 11:29 UTC. All times on this page are UTC.
Applications that use Firebase Authentication or Google Cloud Identity Platform on iOS with the auth handler reachable by a remote attacker who controls a bundle ID. Apps not using these services, or not using the iOS auth flow, are likely unaffected. Exact exposure conditions are unknown from the NVD description alone.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
This page as .md · .json · in your agent: get_signal("CVE-2026-85268")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.