Which versions of Google Web Designer are affected by CVE-2026-3223?

Google Web Designer installations are vulnerable to code execution attacks triggered when employees open maliciously-crafted design files or archives, creating direct risk of system compromise and…

How to fix or mitigate CVE-2026-3223?

Within 24 hours: Identify all installations of Google Web Designer versions 14.2.2.0 and earlier in your environment, notify affected users to treat all project files and templates from external or untrusted sources as potentially malicious, and document which business units depend on this tool. Within 7 days: Enforce a policy restricting project imports to internally-created files only, disable archive auto-import and template auto-loading features in Google Web Designer if available, and require manual review of all imported content before use. Within 30 days: Monitor Google's official security advisories for patch releases and deploy immediately upon availability; if no patch materializes after 30 days, begin evaluation of alternative design tools and develop migration plans for business continuity.

Google Web Designer CVE-2026-3223

Q: What is the CVSS score of CVE-2026-3223?

CVE-2026-3223 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Path Traversal (CWE-22)

2026-02-27 cve-coordination@google.com

Privilege Escalation Path Traversal Google Web Designer

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector requiring the victim to open a malicious archive (AV:L, UI:R); no prior privileges needed (PR:N); arbitrary file write yields high confidentiality, integrity and availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 14, 2026 - 00:37 NVD

8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 14:16 cve.org

HIGH 8.4

CVE Published

Feb 27, 2026 - 14:16 nvd

N/A

DescriptionCVE.org

Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.

AnalysisAI

Arbitrary file write in Google Web Designer 14.2.2.0 lets an attacker overwrite files outside the intended extraction directory via a Zip Slip path-traversal flaw, potentially escalating to privilege escalation or code execution. Exploitation requires a victim to open or import a maliciously crafted archive (project, template, or asset bundle) in the application. The issue was reported through Google's Vulnerability Reward Program; there is no public exploit identified at time of analysis and EPSS rates real-world exploitation probability at just 0.01%.

Technical ContextAI

Google Web Designer is a free desktop application (Windows/macOS/Linux) used to build HTML5 creatives, ads, and interactive web content, frequently importing and exporting content as compressed archives. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), manifesting specifically as a 'Zip Slip' weakness: when the application extracts a ZIP/archive it fails to canonicalize and validate entry names, so an archive entry containing directory-traversal sequences (e.g. '../../') is written to an attacker-chosen parent or absolute path rather than being confined to the extraction folder. The affected build per the NVD CPE is cpe:2.3:a:google:web_designer:14.2.2.0. Because the extracted files can land in startup, configuration, or binary directories, the arbitrary file write can be leveraged for the 'potential privilege escalation' noted in the report.

RemediationAI

Upgrade Google Web Designer to the latest available release, as Google typically resolves reported VRP issues in subsequent builds; no exact fixed version is provided in the available data, so verify the patched build against the Google Web Designer release notes and the VRP report at https://bughunters.google.com/reports/vrp/FJMQGy8oo before deploying (No vendor-released patch version identified at time of analysis). As a compensating control until a confirmed fix is installed, treat Google Web Designer project files, templates, and asset archives from untrusted or external sources as dangerous - do not open or import archives received via email, download, or shared drives, and where possible restrict the application to files originating from trusted internal repositories. Running the application under a low-privileged (non-administrator) user account limits the impact of an arbitrary file write and reduces the privilege-escalation potential, at the cost of some convenience for users who install extensions or write to protected directories.