Cross-Site Scripting Vulnerability in SketchUp's Dynamic Components Feature

CVE-2026-9264

What is CVE-2026-9264?

A cross-site scripting vulnerability exists in SketchUp 2026's Dynamic Components feature, allowing attackers to execute arbitrary system commands and access local files without user interaction. This security flaw arises from the improper sanitization of user input in the component options window, enabling the exploitation of an embedded Internet Explorer 11 browser when processing maliciously crafted SKP files. If successfully exploited, this vulnerability can lead to significant risks, including the execution of remote code and local file exfiltration.

References