CVE-2026-85268

CVSS 8.7 (high) · published 2026-10-30

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

Weakness: CWE-79

Source: NVD CVE-2026-85268

References

• https://firebase.google.com/support/releases#auth-helper-fix

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.