CVE-2026-9264
Critical
Description
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
SeverityCritical
CVSS9.3
Exploit probability—
ProductSketchUp
PublishedMay 22, 2026
First seenMay 22, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- Trimble SketchUp2026.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Trimble SketchUp | v < 2026.1.3 | 2026.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.