CVE-2026-57670: Unauthenticated XSS in Google Maps CP ≤1.2.5 – HIGH Severity Vulnerability

Technical summary

CVE-2026-57670 is an unauthenticated, reflected or stored XSS vulnerability (CWE-79) in Google Maps CP up to version 1.2.5. The vulnerability has a CVSS v3.1 score of 7.1 (HIGH) with a network-based attack vector, low attack complexity, and no privilege requirements. The attack requires user interaction and has a changed scope, resulting in low confidentiality, integrity, and availability impact per the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The flaw allows unauthenticated actors to craft malicious payloads that execute in the context of a victim's browser session.

Business impact

Organizations running Google Maps CP ≤1.2.5 face exposure to session hijacking, credential theft, malware distribution, and defacement attacks targeting their users. If the vulnerable component is customer-facing, the reputational damage from a successful XSS attack can be substantial. Internal deployments risk data exfiltration or lateral movement if an attacker compromises a user's session. The HIGH severity rating reflects the ease of exploitation and potential for cross-scope impact.

Affected systems

Google Maps CP versions 1.2.5 and earlier are affected. Organizations should inventory deployments of this product and determine version numbers in their environment. Versions after 1.2.5 are presumed patched, though vendor advisory confirmation is recommended.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special privileges, and can be weaponized via phishing emails, watering-hole attacks, or malicious advertisements. The primary barrier to exploitation is user interaction (clicking a malicious link or visiting a compromised page), which is a low hurdle in real-world attack scenarios. No public exploit code disclosure is evident at publication; however, the simplicity of XSS attacks means tooling and payloads are trivial to construct.

Remediation

Update Google Maps CP to a version newer than 1.2.5 as soon as possible. Consult the vendor advisory to confirm the exact patched version. Apply the update in a staged manner if the component is production-critical. Additionally, implement input validation and output encoding in any custom code that integrates with or extends Google Maps CP, and consider Web Application Firewall (WAF) rules to detect and block XSS payloads.

Patch guidance

Upgrade Google Maps CP to the latest available version beyond 1.2.5. Verify patch availability and compatibility with your deployment environment through the official Google Maps CP documentation or vendor advisory. Test the patched version in a non-production environment before rolling out to production systems. If a patch is not yet available, implement temporary mitigations such as WAF rules or disabling the vulnerable feature until patching is complete.

Detection guidance

Monitor web server and application logs for suspicious script injection attempts in URL parameters, form fields, or POST bodies. Look for encoded or obfuscated JavaScript payloads, event handlers (e.g., 'onerror=', 'onload='), and script tags in HTTP requests. WAF alerts for XSS patterns should be reviewed. Additionally, monitor user session anomalies such as unexpected access from new geographic locations or devices, which may indicate session compromise via XSS. Browser console errors and unusual DOM modifications in client-side monitoring tools can also signal active attacks.

Why prioritize this

Although CVE-2026-57670 is not yet on the CISA Known Exploited Vulnerabilities (KEV) catalog, its HIGH CVSS score, zero authentication requirement, and ubiquitous use of mapping functionality in web applications make it a priority for immediate remediation. XSS flaws are consistently among the top vectors in breach chains. Organizations should treat this as a near-critical priority for environments where Google Maps CP is customer-facing or processes sensitive data.

Risk score, explained

The CVSS 7.1 (HIGH) rating reflects the attack's network accessibility, low complexity, and cross-scope impact. While individual users experience limited confidentiality and integrity harm from a single XSS payload, the cumulative risk to an organization—especially if multiple users are compromised—justifies urgent patching. The rating does not assume widespread active exploitation yet, but the ease of XSS weaponization means that window is likely short.

Frequently asked questions