Vulnerability Intelligence Report
Cross-Site Scripting in SketchUp Dynamic Components
CVE-2026-9264
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
Exploitability:2.6
Impact Score:6.1
EPSS Probability:0.23%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-94 ↗CWE-94: Improper Control of Generation of Code
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Trimble | SketchUp | 0 < 2026.1.3 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.231%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Bugcrowd Inc. · Bug Bounty Provider · USA |
| Reserved | 2026-05-22T00:57:32 |
| Published | 2026-05-22T01:04:03 |
| Last Updated | 2026-05-22T15:52:45 |
Community Chatter & Buzz