This vulnerability (CVE-2026-15810) is a reflected XSS issue in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7. An attacker can craft a malicious URL that, if visited by an authenticated administrator, enables execution of arbitrary JavaScript code, potentially resulting in administrative account compromise. Google has already mitigated this vulnerability for Looker-hosted instances. For self-hosted deployments, patches have been released in the specified versions and later, and upgrading to these versions is required to fix the vulnerability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser, which can lead to administrative account takeover. This compromises the confidentiality and integrity of the administrator's account and potentially the entire Looker environment. The CVSS 4.0 score is 8.7 (high), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

For Looker-hosted instances, no action is required as Google has already applied mitigations. For self-hosted Looker instances, administrators must upgrade to patched versions: 25.6.103 or later, 25.12.65 or later, 25.18.68 or later, 26.0.66 or later, 26.2.47 or later, 26.4.36 or later, 26.6.28 or later, or 26.8.7 or later. Applying these updates will remediate the vulnerability.