Quick answers
- Is CVE-2026-9264 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9264 being exploited in the wild.
- How severe is CVE-2026-9264?
- Informational severity, with a CVSS score of 8.8, published 22 May 2026.
- Which products and versions are affected?
- Trimble SketchUp 2026.
- Is there a fix for CVE-2026-9264?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9264 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-9264?
- Check whether you run Trimble SketchUp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Dynamic Components feature of Trimble SketchUp 2026. The flaw is caused by improper input sanitization within the component options window, which utilizes an embedded Internet Explorer 11 browser instance. An attacker can exploit this by crafting a malicious .SKP file containing embedded scripts; when a user opens the file and interacts with the component options, the script executes within the context of the application. This allows the attacker to bypass browser sandboxing to execute arbitrary system commands and exfiltrate local files. While the attack vector is local (requiring the user to open a file), the impact is high as it leads to full remote code execution (RCE).
Affected products
- Trimble SketchUp 2026 2026
Timeline
- 2026-05-21: disclosed: Vulnerability reported by Bugcrowd Inc.
- 2026-05-22: advisory: CVE-2026-9264 published to NVD.