CVE-2026-9264: Cross-Site Scripting in SketchUp Dynamic Components
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9264?
CVE-2026-9264 has a risk rating of 89, indicating a high level of severity.
How do I fix CVE-2026-9264?
To mitigate CVE-2026-9264, ensure you are using the latest version of Trimble SketchUp and apply all relevant security patches.
What type of attack does CVE-2026-9264 enable?
CVE-2026-9264 enables cross-site scripting (XSS) attacks, allowing for remote code execution and local file exfiltration.
Which feature of SketchUp is affected by CVE-2026-9264?
CVE-2026-9264 specifically affects the Dynamic Components feature in SketchUp 2026.
Who is impacted by the CVE-2026-9264 vulnerability?
Users of Trimble SketchUp 2026, particularly those utilizing Dynamic Components, are at risk from CVE-2026-9264.