Google Cloud Shell: Cross-Site WebSocket Hijacking
Summary
Cloud Shell, a browser-based terminal environment on Google Cloud Platform, did not sufficiently validate the origin of WebSocket connections. A cross-origin WebSocket request from an attacker-controlled web page can hijack an active Cloud Shell session and exfiltrate the user's OAuth access token. The attack requires the victim to have an active session and to visit the malicious page; no customer action is needed because Google fixed the service.
Affected
- Google Cloud Cloud Shell before 2026-07-22 (versions are identified by date, no version numbers published)
- Default configuration: unaffected
Fixed in
- Fixed server-side by Google on 22 July 2026 (CVE record); release notes entry dated 28 July 2026
- Fix: stricter Origin header validation on WebSocket upgrades and an allowed port list for TCP and SSH tunnels
Workaround
- None required; Google fixed the service.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV (per secondary feed); other database lists "Not exploited".
- A public research write-up (WSSnatch) describes a demonstrated attack chain requiring an active session; not reproduced.
- EPSS about 0.2%.
- Unknown whether customer tokens were stolen in practice.
Our recommendation
- No customer patch or configuration change is required.
- Review Google Cloud audit logs for administrator activity in Cloud Shell before 22 July 2026, especially if sessions were used while browsing untrusted sites.
- If anything looks unusual, rotate credentials and revoke active sessions.
- Limit IAM roles to the minimum needed and avoid browsing untrusted sites while logged into cloud consoles or active terminals.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Cloud Shell release notes (July 28, 2026) docs.cloud.google.com
- Cymulate research: WSSnatch token theft cymulate.com
- GitHub CVE alert feed (CVE-2026-85267) github.com
- VulnCheck/Vulners VulnRichment entry vulners.com
- CyStack vulnerability database entry cystack.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:32.
Original description (NVD)
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched on 22 July 2026, and no customer action is needed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.