Firebase Authentication CVE-2026-85268

Exploitation targets the auth/handler of Google Cloud Identity Platform / Firebase Authentication on iOS specifically, using a malicious iOS bundle ID that the handler reflects without proper sanitization. Per the CVSS vector it is unauthenticated (PR:N) and remote (AV:N) but requires victim interaction (UI:P) - the attack is not fully autonomous drive-by; a user must enter or engage with the manipulated authentication flow. It is limited to versions prior to the 2026-08-14 fix and to the iOS code path; non-iOS clients and patched versions are not affected. The practical ceiling on impact is that the attacker must first draw a victim into the vulnerable auth flow.

This is a reflected/DOM-style Cross-Site Scripting flaw (CWE-79) in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS, triggered via a malicious iOS bundle ID. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires passive user interaction (UI:P) - so exploitation is not fully drive-by; a victim must engage with attacker-influenced content. The vuln.today decision label is 'this_week', consistent with a serious but not emergency-grade issue. There is no CISA KEV listing and no EPSS score provided, and no public exploit is identified at the time of analysis, so there is no evidence of active or widespread exploitation; the signals point to a patch-promptly priority rather than a fire-drill. One tension worth flagging: the input vector rates VC/VI/VA all High, which is aggressive for an XSS (availability impact in particular is atypical for script injection) - this likely reflects the sensitivity of the authentication context (token/credential theft, account takeover) rather than a literal denial-of-service capability; verify impact scope with Google's advisory.

An attacker crafts a malicious iOS bundle ID that is reflected unsanitized by the auth/handler, then lures a victim into an authentication flow that processes it (UI:P). When the victim's client renders the handler response, attacker-controlled JavaScript executes in the authentication context, enabling theft of authentication tokens or session data and potential account takeover. No public exploit code is identified at the time of analysis.