EUVD-2026-113761: XSS flaw in Google Identity Platform and Firebase Auth on iOS
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Google Cloud
- Product
- Identity Platform and Firebase Authentication
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113761 describes a cross-site scripting flaw (CWE-79, CVSS 8.7) in Identity Platform and Firebase Authentication on iOS before 2026-08-14. The entry says it allows an unauthenticated remote attacker to act against users, and the item's text is truncated.
If you use Google Cloud
Confirm your Identity Platform and Firebase Authentication SDK versions are at or after the fixed release
Review the EUVD-2026-113761 entry for the full impact and affected components
Check authentication handler logs for unusual requests on iOS clients
Confirm Application Integration is on a version dated 2026-09-11 or later
Restrict which users can create or edit integrations until verified
Review integrations that use SubWorkflow tasks for unexpected changes
What the sources say 2
· Mastodon: “A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker t...” Source
· Mastodon: “A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a ...” Source