A Cross‑Site Scripting flaw in the Firebase authentication redirect handler on iOS permits an attacker to embed unsanitized JavaScript inside a malicious bundle identifier. When an unauthenticated user follows a crafted redirect, the malformed bundle ID is rendered and executed in the context of the user’s session, potentially allowing the attacker to steal credentials, hijack sessions, or modify data and state, thereby impacting confidentiality, integrity, and availability.

The issue affects Google Cloud Identity Platform and Firebase Authentication services that use the auth/handler component before the release dated 2026‑08‑14 on iOS. In particular, applications that follow the best‑practice flow and have self‑hosted the helper code under Option 4 are exposed; all other users of the managed SDKs are not affected after the patch date.

The CVSS score of 8.7 indicates a high‑severity vulnerability. No EPSS metric is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation. The likely attack vector is a crafted redirect containing a malicious iOS bundle ID, and the flaw requires no attacker authentication, making the risk significant for projects still using older helper code.