CVE-2026-9264: SketchUp 2026 RCE Vulnerability

CVE-2026-9264 Overview

CVE-2026-9264 is a cross-site scripting (XSS) vulnerability in the Dynamic Components feature of SketchUp 2026. The flaw resides in the component options window, which fails to sanitize user-supplied input. Attackers craft malicious SKP files that execute arbitrary JavaScript inside an embedded Internet Explorer 11 (IE11) browser used to render component dialogs. Successful exploitation leads to remote code execution and local file exfiltration without any user interaction beyond opening the file. The vulnerability is tracked under [CWE-94] (Improper Control of Generation of Code) and was disclosed through the Trimble Trust Advisory.

Critical Impact

A single malicious .skp file delivers code execution and reads arbitrary local files in the context of the user running SketchUp 2026.

Affected Products

• Trimble SketchUp 2026
• SketchUp 2026 Dynamic Components feature
• Embedded Internet Explorer 11 rendering component within SketchUp

Discovery Timeline

• 2026-05-22 - CVE-2026-9264 published to NVD
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-9264

Vulnerability Analysis

The vulnerability exists in how SketchUp 2026 processes attribute values associated with Dynamic Components. When a user opens a crafted SKP file, the application renders component metadata inside the component options window. That window uses an embedded IE11 instance to display HTML content derived from component attributes. Because the application does not sanitize or encode these attribute values, attacker-controlled markup and JavaScript execute in the embedded browser context. The IE11 rendering surface inherits the desktop application's privileges, allowing JavaScript to invoke ActiveX objects and shell scripting interfaces.

The XSS condition therefore escalates beyond traditional browser-bound impact. Attackers reach WScript.Shell and Scripting.FileSystemObject equivalents to spawn processes and read files on disk. The scope change reflected in the CVSS metrics maps to this pivot from script context into the host operating system.

Root Cause

The root cause is missing input sanitization in the Dynamic Components attribute parser. SKP files store component metadata as strings that the options window later renders as HTML. The application concatenates these strings into the IE11 document without HTML encoding or content security policy enforcement. Because IE11 lacks modern browser protections such as CSP enforcement defaults and Trusted Types, injected scripts execute with full privileges granted to the WebBrowser control.

Attack Vector

An attacker delivers a malicious SKP file through email attachments, model marketplaces, shared project drives, or compromised content distribution channels. When the victim opens the file in SketchUp 2026 and interacts with the affected component, injected JavaScript runs immediately. The payload reads local files, exfiltrates them over outbound HTTP requests, and launches arbitrary commands. Because the rendering occurs as part of standard component display, no additional user interaction beyond opening the file is required.

No verified proof-of-concept code has been published. Refer to the Trimble Trust Advisory for vendor technical details.

Detection Methods for CVE-2026-9264

Indicators of Compromise

• SKP files received from untrusted sources containing unusually long or HTML-encoded Dynamic Component attribute strings
• SketchUp.exe spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or cscript.exe
• Outbound network connections initiated by SketchUp.exe to non-Trimble domains shortly after opening a model file
• File read activity from SketchUp.exe targeting user profile paths such as Documents, Desktop, or credential stores

Detection Strategies

• Hunt for process lineage where SketchUp.exe is the parent of any scripting or command interpreter binary
• Inspect SKP files for embedded <script>, javascript:, or event handler strings inside Dynamic Component attribute fields
• Monitor for IE11 WebBrowser control instantiation by SketchUp followed by file system enumeration

Monitoring Recommendations

• Enable command-line auditing on workstations running SketchUp 2026 and forward events to a centralized analytics platform
• Alert on SketchUp creating files in startup, scheduled task, or autorun registry locations
• Correlate SketchUp file-open events with subsequent outbound HTTP POST requests carrying base64-encoded payloads

How to Mitigate CVE-2026-9264

Immediate Actions Required

• Apply the fixed SketchUp release identified in the Trimble Trust Advisory as soon as it is available
• Block delivery of SKP files from untrusted external senders at the email gateway
• Restrict execution of script interpreters when launched as child processes of SketchUp.exe using application control policies

Patch Information

Trimble has published an advisory addressing the Dynamic Components sanitization defect. Review the Trimble Trust Advisory for the patched build number and update instructions. Deploy the patched version across all workstations running SketchUp 2026 and verify the installed version after deployment.

Workarounds

• Avoid opening SKP files from unknown or unverified sources until the patch is applied
• Disable the Dynamic Components extension where it is not required for business workflows
• Apply Windows Defender Application Control or AppLocker rules preventing SketchUp.exe from launching cmd.exe, powershell.exe, wscript.exe, and cscript.exe
• Run SketchUp under a standard user account with restricted file system permissions to limit exfiltration scope

# Example AppLocker rule fragment blocking script interpreter children of SketchUp
# Deploy via Group Policy: Computer Configuration > Windows Settings > Security Settings > Application Control Policies
<FilePathRule Action="Deny" UserOrGroupSid="S-1-1-0">
  <Conditions>
    <FilePathCondition Path="%SYSTEM32%\WScript.exe" />
    <FilePathCondition Path="%SYSTEM32%\cscript.exe" />
    <FilePathCondition Path="%SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe" />
  </Conditions>
  <ParentProcessCondition Path="*\SketchUp.exe" />
</FilePathRule>