Is CVE-2026-15810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15810 being exploited in the wild.

How severe is CVE-2026-15810?

High severity, with a CVSS score of 8.7, published 24 July 2026.

Which products and versions are affected?

Google Looker prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7.

Is there a fix for CVE-2026-15810?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15810 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-15810?

Check whether you run Google Cloud Platform or Google Looker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15810: Google Cloud Looker XSS leading to administrative account takeover

CVE-2026-15810 · Severity: high · CVSS 8.7 · Published 2026-07-24

Google Cloud Looker, a business intelligence and data analytics platform, is affected by a security flaw that could allow an attacker to take over administrative accounts. By tricking a Looker administrator into clicking a specially crafted link, an attacker can execute malicious code within the administrator's browser session. This could lead to unauthorized access to sensitive corporate data, modification of analytics models, or full control over the Looker instance.

Technologies: Google Cloud Platform. Vendors: Google.

Quick answers

Is CVE-2026-15810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15810 being exploited in the wild.
How severe is CVE-2026-15810?: High severity, with a CVSS score of 8.7, published 24 July 2026.
Which products and versions are affected?: Google Looker prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7.
Is there a fix for CVE-2026-15810?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15810 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-15810?: Check whether you run Google Cloud Platform or Google Looker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in both Looker-hosted and self-hosted versions of Google Cloud Looker. The flaw allows an unauthenticated attacker to craft a malicious URL that, when visited by an authenticated administrator, executes arbitrary JavaScript in the context of the victim's session. This execution can be leveraged to perform actions on behalf of the administrator, potentially leading to full account takeover. Google has mitigated the issue for Looker-hosted instances, but self-hosted customers must manually upgrade to patched versions (e.g., 26.8.7+, 26.6.28+, 25.6.103+).

Affected products

Google Cloud Looker prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7

Timeline

2026-07-22: advisory: Google Cloud security bulletin GCP-2026-049 published
2026-07-24: disclosed: CVE-2026-15810 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.