Security Advisory: Cross-Site Scripting in SketchUp Dynamic Components
Description
Cross-Site Scripting (XSS) within the Component Options window has been identified in the
SketchUp Dynamic Components extension that may allow an attacker to execute arbitrary code
or exfiltrate local files.
Impacted versions
Product Version
SketchUp Desktop (Windows & Mac) Versions prior to 2026.1.2
Dynamic Components Extension All versions prior to the March 2026 security
release
Impact
Successful exploitation of this vulnerability requires a user to interact with a malicious SketchUp
file (.skp). The impact may include:
● Remote Code Execution (RCE) via ActiveX
● Local file exfiltration
Remediation and Mitigation
Users should update their SketchUp Desktop installation to version 2026.1.2 or later. Updating
the SketchUp application will automatically include the patched version of the Dynamic
Components extension.
Acknowledgments
This vulnerability was discovered and reported through the Trimble Bug Bounty Program on
Bugcrowd. We would like to thank the security researcher for their professional disclosure and
assistance in securing our products.
References
● SketchUp Release Notes https://help.sketchup.com/en/sketchup-desktop-202612
Welcome to Trimble's Trust Portal, your resource for product security, privacy, and compliance information including our security controls and certifications. At Trimble, trust is at the core of everything we do which is a testament to our Commitment to Customers. We understand the importance of safeguarding your data while providing innovative solutions that empower your business. That's why we've established the Trimble Trust Portal, your one-stop destination for transparency, security, and compliance information.
Explore our Trust Portal to gain a deeper understanding of how Trimble ensures the confidentiality, integrity, and availability of your data. From detailed privacy policies to certifications and attestations, we believe in transparency every step of the way.
Together, we can achieve excellence in data protection and uphold the highest standards of integrity and compliance. Thank you for choosing Trimble as your trusted partner.
Baker Tilly US