CVE-2026-48294

Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://chromewebstore.google.com/detail/adobe-acrobat-pdf-edit-co/efaidnbmnnnibpcajpcglclefindmkaj	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:chrome:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 26.5.2.2 y anteriores de la Extensión de Adobe Acrobat PDF (Chrome) están afectadas por una vulnerabilidad de divulgación de datos de origen cruzado de clase UXSS. Un atacante podría explotar esta vulnerabilidad para obtener acceso a datos relacionados con la sesión de la víctima. La explotación de este problema requiere interacción del usuario, en el sentido de que una víctima debe visitar una URL creada con fines maliciosos o interactuar con una página web comprometida. El alcance ha cambiado.

Information

Published : 2026-06-17 10:55

Updated : 2026-10-26 11:10

NVD link : CVE-2026-48294

Mitre link : CVE-2026-48294

CVE.ORG link : CVE-2026-48294

JSON object : View

Products Affected

adobe

acrobat

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-48294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48294", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T20:59:32.500542Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Acrobat PDF Extension (Chrome)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "26.5.2.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-17T10:55:01.660", "references": [{"url": "https://chromewebstore.google.com/detail/adobe-acrobat-pdf-edit-co/efaidnbmnnnibpcajpcglclefindmkaj", "tags": ["Product"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}, {"lang": "es", "value": "Las versiones 26.5.2.2 y anteriores de la Extensi\u00f3n de Adobe Acrobat PDF (Chrome) est\u00e1n afectadas por una vulnerabilidad de divulgaci\u00f3n de datos de origen cruzado de clase UXSS. Un atacante podr\u00eda explotar esta vulnerabilidad para obtener acceso a datos relacionados con la sesi\u00f3n de la v\u00edctima. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que una v\u00edctima debe visitar una URL creada con fines maliciosos o interactuar con una p\u00e1gina web comprometida. El alcance ha cambiado."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:chrome:*:*", "vulnerable": true, "matchCriteriaId": "551B31B9-B230-4FE4-B0C1-0F327D4B29AA", "versionEndIncluding": "26.5.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}