Google Cloud Shell Cross-Site WebSocket Hijacking Patched

Google Cloud Shell contained a Cross-Site WebSocket Hijacking flaw that exposed active user sessions to unauthenticated attackers. The vulnerability, tracked as CVE-2026-85267, allowed malicious actors to intercept WebSocket connections. This exposure occurred in environments running Cloud Shell versions prior to the 22 July 2026 update. Security teams should note that the issue required no authentication to exploit, lowering the barrier for potential abuse against active users.

Root cause

The underlying weakness is classified as CWE-1385, which relates to Cross-Site WebSocket Hijacking. The vulnerability is described as a Cross-Site WebSocket Hijacking issue in Cloud Shell. The source material does not specify the exact code-level cause or validation failure. It identifies the flaw as allowing an unauthenticated attacker to hijack an active session. The classification points to the nature of the attack vector rather than a specific implementation error.

Attack path

An attacker could exploit this by sending a crafted cross-origin WebSocket request to a victim’s active Cloud Shell session. Because the vulnerability allowed unauthenticated access, the attacker did not need valid credentials to initiate the hijack. Once the connection was established, the attacker could exfiltrate the user’s OAuth access token. The source material states the attacker can exfiltrate the token using a cross-origin WebSocket request.

Affected versions

• Google Cloud Cloud Shell versions released before 22 July 2026 were affected.
• Environments running updates issued on or after 22 July 2026 are not vulnerable.
• No specific version numbers were cited in the advisory, only the date threshold.

Mitigation

• Ensure all Cloud Shell instances are updated to versions released on or after 22 July 2026.
• Verify that automatic update mechanisms are enabled for Google Cloud Platform components.
• Review OAuth token lifetimes and scopes to limit potential impact from token theft.

Signals worth monitoring

Teams usually detect WebSocket hijacking by analysing network logs for anomalous cross-origin connection attempts. Check whether WebSocket endpoints receive requests from unexpected domains or user agents. Monitor for sudden spikes in token usage or access patterns that deviate from typical user behaviour. Look for authentication events occurring from unfamiliar IP addresses shortly after session initiation. Containment often involves revoking active OAuth tokens and forcing session re-authentication. Investigate any outbound data transfers from shell sessions that lack corresponding user input.

What to do and how to stay safe: Google Cloud

• Audit Cloud Shell instances to confirm they are running the patched version.
• Review OAuth token usage logs for signs of unauthorised access or exfiltration.
• Implement strict origin validation for WebSocket connections in custom applications.
• Monitor for unusual cross-origin requests targeting shell endpoints.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability being actively exploited?

The source material does not state whether the flaw is currently being exploited in the wild.

Do I need to take manual action to fix this?

No customer action is needed, as the patch was applied automatically by Google.

What is the severity of CVE-2026-85267?

The National Vulnerability Database rates it as HIGH with a CVSS score of 8.7.