A Cross-Site Scripting (XSS) vulnerability exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS versions prior to 2026-08-14. This flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. The vulnerability has a high severity rating with a CVSS score of 8.7.