CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26

Synopsis

A Universal Cross-Site Scripting (UXSS) vulnerability affects the Adobe Acrobat PDF Extension for Chrome versions 26.5.2.2 and earlier. The flaw is reachable over the network without authentication, but requires the victim to visit a maliciously crafted URL or interact with a compromised web page. Successful exploitation allows an attacker to read cross-origin session data from the victim's browser, crossing the browser's same-origin security boundary. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild as soon as an upstream fix is available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim must be able to reach a maliciously crafted URL or a compromised web page hosted on an external or internal network endpoint.

• AuthenticationNot required

  No account or credential of any kind is required; any anonymous party who can lure the victim to the malicious page can attempt exploitation.

• Victim interactionRequired

  The victim must actively visit a maliciously crafted URL or interact with a compromised web page, making social engineering a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental preconditions beyond victim interaction.

Blast Radius

• Reads cross-origin browser session data, including cookies, tokens, and page content from sites the victim has open, bypassing the same-origin policy.
• Gains access to authenticated session context from third-party origins, enabling session hijacking or credential harvesting without direct credential theft.
• Confidentiality impact is high; integrity and availability are unaffected, so the attacker observes data but does not modify or destroy it.