Cloud Shell
Monthly
Cross-site WebSocket hijacking in Google Cloud Shell prior to 2026-07-22 lets an unauthenticated remote attacker hijack an active, authenticated Cloud Shell session and exfiltrate the user's OAuth access token. Exploitation requires the victim to have a live Cloud Shell session and to load an attacker-controlled page that issues a cross-origin WebSocket request, which is the user-interaction precondition reflected in the CVSS vector. Google remediated the hosted service server-side on 2026-07-22, and no public exploit was identified at time of analysis.
Cross-site WebSocket hijacking in Google Cloud Shell prior to 2026-07-22 lets an unauthenticated remote attacker hijack an active, authenticated Cloud Shell session and exfiltrate the user's OAuth access token. Exploitation requires the victim to have a live Cloud Shell session and to load an attacker-controlled page that issues a cross-origin WebSocket request, which is the user-interaction precondition reflected in the CVSS vector. Google remediated the hosted service server-side on 2026-07-22, and no public exploit was identified at time of analysis.