Arbitrary File Write and Privilege Escalation in Google Web Designer
CVE-2026-3223

8.4HIGH

Key Information:

Vendor

Google
Status
Web Designer
Vendor
CVE Published:
27 February 2026

What is CVE-2026-3223?

Google Web Designer is susceptible to a zip slip vulnerability that enables arbitrary file writing and may result in potential privilege escalation. Attackers can exploit this flaw by constructing a crafted ZIP file that extracts content outside the intended directory, facilitating unauthorized access and modifications to sensitive files on the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Web Designer 0 < 14.2.2.0

References

https://bughunters.google.com/reports/vrp/FJMQGy8oo

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.