# CVE-2026-15810: Google Cloud Looker XSS leading to administrative account takeover

Source: https://junglewise.ai/threats/cve-2026-15810-google-cloud-looker-xss-leading-to-administrative-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-15810 · Severity: high · CVSS 8.7 · Published 2026-07-24

Google Cloud Looker, a business intelligence and data analytics platform, is affected by a security flaw that could allow an attacker to take over administrative accounts. By tricking a Looker administrator into clicking a specially crafted link, an attacker can execute malicious code within the administrator's browser session. This could lead to unauthorized access to sensitive corporate data, modification of analytics models, or full control over the Looker instance.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-15810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15810 being exploited in the wild.

**How severe is CVE-2026-15810?** High severity, with a CVSS score of 8.7, published 24 July 2026.

**Which products and versions are affected?** Google Looker prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7.

**Is there a fix for CVE-2026-15810?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15810 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-15810?** Check whether you run Google Cloud Platform or Google Looker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in both Looker-hosted and self-hosted versions of Google Cloud Looker. The flaw allows an unauthenticated attacker to craft a malicious URL that, when visited by an authenticated administrator, executes arbitrary JavaScript in the context of the victim's session. This execution can be leveraged to perform actions on behalf of the administrator, potentially leading to full account takeover. Google has mitigated the issue for Looker-hosted instances, but self-hosted customers must manually upgrade to patched versions (e.g., 26.8.7+, 26.6.28+, 25.6.103+).

## Affected products

- Google Cloud Looker prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7

## Timeline

- 2026-07-22: advisory: Google Cloud security bulletin GCP-2026-049 published
- 2026-07-24: disclosed: CVE-2026-15810 published to NVD

## References

- [https://docs.cloud.google.com/looker/docs/release-notes](https://docs.cloud.google.com/looker/docs/release-notes)
- [https://docs.cloud.google.com/support/bulletins](https://docs.cloud.google.com/support/bulletins)

## Related threats

- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Istio authentication bypass or access control vulnerability](https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080)
- [Slurm multiple vulnerabilities in Cluster Toolkit](https://junglewise.ai/threats/cve-2026-65107-slurm-sbcast-shared-library-validation-bypass)
- [Google Application Integration deserialization of untrusted data in SubWorkflow](https://junglewise.ai/threats/cve-2026-93327-gcp-2026-074)
- [Google Compute Engine incorrect authorization in disk access](https://junglewise.ai/threats/cve-2026-85299-gcp-2026-073)