---
id: CVE-2026-85267
title: Cross-Site WebSocket Hijacking in Google Cloud Shell
summary: >-
  A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to
  2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to
  hijack an active Cloud Shell session and exfiltrate the user's OAuth access
  token using a cr…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear'
cvssSource: cna
cwe:
  - CWE-1385
vendor: Google Cloud
product: Cloud Shell
affected:
  - cloud_shell < 2026-07-22
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T09:16:56.533Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85267'
references:
  - url: 'https://docs.cloud.google.com/shell/docs/release-notes#July_28_2026'
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.349Z'
---

## Overview

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request.


This vulnerability was patched on 22 July 2026, and no customer action is needed.

## Affected

- `cloud_shell < 2026-07-22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.