Description
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
Published: 2026-10-30
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

This vulnerability has been patched for all users and no app updates are required. Action is only needed for developers who followed Option 4 (self-hosting the helper code) in the Firebase redirect best practices documentation https://firebase.google.com/docs/auth/web/redirect-best-practices#self-host-helper-code. These users should re-synchronize the helper code to make sure they are hosting the latest version.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
Title Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-10-30T10:20:06.249Z

Reserved: 2026-09-03T16:36:41.159Z

Link: CVE-2026-85268

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T11:17:33.750

Modified: 2026-10-30T11:17:33.750

Link: CVE-2026-85268

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T12:00:15Z

Weaknesses