CVE-2026-3223
Published: 27 February 2026
Summary
CVE-2026-3223 is a high-severity Path Traversal (CWE-22) vulnerability in Google Web Designer. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents zip slip path traversal by validating file paths during zip extraction in Google Web Designer.
Remediates the specific zip slip vulnerability through timely flaw identification, reporting, and patching in Google Web Designer.
Limits damage from arbitrary file writes and privilege escalation by enforcing least privilege on the affected process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Zip slip (CWE-22 path traversal) in archive extraction directly enables arbitrary file write via a malicious file opened by the user (T1204.002) and facilitates local privilege escalation (T1068).
NVD Description
Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer.
Deeper analysisAI
CVE-2026-3223 is a zip slip vulnerability in Google Web Designer that enables arbitrary file write and potential privilege escalation. Classified under CWE-22 (Path Traversal), it carries a CVSS v3.1 base score of 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability was published on 2026-02-27T14:16:30.923.
A local attacker can exploit this issue with low attack complexity and no required privileges, though user interaction is necessary. Successful exploitation allows high-impact consequences across confidentiality, integrity, and availability, including arbitrary file writes that could facilitate privilege escalation on the affected system.
Mitigation details are available in the referenced advisory at https://bughunters.google.com/reports/vrp/FJMQGy8oo.
Details
- CWE(s)