Identity Platform And Firebase Authentication
Monthly
Cross-site scripting in the iOS auth/handler component of Firebase Authentication and Google Cloud Identity Platform (builds prior to 2026-08-14) lets a remote, unauthenticated attacker execute arbitrary JavaScript inside the authentication flow by supplying a crafted iOS bundle ID that the handler reflects without sanitization. The independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - scope-changed script execution with high confidentiality impact, but the attacker must first draw a victim into the manipulated auth flow, so it is not a fully autonomous drive-by. Exposure is confined to the iOS code path and to versions older than the 2026-08-14 fix; non-iOS clients and patched builds are not affected, and no public exploit has been identified at time of analysis.
Cross-site scripting in the iOS auth/handler component of Firebase Authentication and Google Cloud Identity Platform (builds prior to 2026-08-14) lets a remote, unauthenticated attacker execute arbitrary JavaScript inside the authentication flow by supplying a crafted iOS bundle ID that the handler reflects without sanitization. The independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - scope-changed script execution with high confidentiality impact, but the attacker must first draw a victim into the manipulated auth flow, so it is not a fully autonomous drive-by. Exposure is confined to the iOS code path and to versions older than the 2026-08-14 fix; non-iOS clients and patched builds are not affected, and no public exploit has been identified at time of analysis.