Google Cloud Shell WebSocket Flaw Exposed Users’ OAuth Tokens

Cymulate Research disclosed WSSnatch, a cross-site WebSocket hijacking vulnerability in Google Cloud Shell tracked as CVE-2026-85267, with a CVSS 4.0 score of 8.7 (High). The demonstrated exploit combined cross-site cookie authentication, missing WebSocket Origin validation, and an unrestricted TCP tunnel to steal an active user’s OAuth access token from an internal metadata proxy. Remote exploitation required the victim to visit an attacker-controlled page and the attacker to know the victim’s editor hostname. A same-network variant used interception to discover that hostname and deliver the exploit without requiring an attacker-link click.

The stolen token enabled Google Cloud access within the victim’s existing IAM permissions, Google Drive access, and identity disclosure; the research did not establish Gmail access or account takeover. Google patched the vulnerability on July 22, 2026, documented mitigations on July 28, and published the CVE on October 20. No customer action is required. For organizations operating similar browser-accessible development environments, the findings underscore the importance of validating WebSocket origins, restricting tunnel destinations, and reviewing cookie authentication behavior to prevent cross-site access to privileged internal services.