CVE-2026-48294
published 2026-06-17CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could…
PriorityP276high7.4CVSS 3.1
AVNACLPRNUIRSCCHINAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.21%
68.4th percentile
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | <= 26.5.2.2 | — |
| adobe | adobe_acrobat_pdf_extension | <= 26.5.2.2 | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
cvelistv5v3.17.4HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
vulncheck7.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe Acrobat PDF Extension up to 26.5.2.2 URL cross site scripting
vuldb·2026-06-29·CVSS 7.4
CVE-2026-48294 [HIGH] Adobe Acrobat PDF Extension up to 26.5.2.2 URL cross site scripting
A vulnerability was found in Adobe Acrobat PDF Extension up to 26.5.2.2 and classified as problematic. This affects an unknown function of the component URL Handler. Executing a manipulation can lead to cross site scripting.
This vulnerability is registered as CVE-2026-48294. It is possible to launch the attack remotely. No exploit is available.
GHSA
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability.
ghsa_unreviewed·2026-06-17
CVE-2026-48294 [HIGH] CWE-79 Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability.
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVEList
CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26
cvelistv5·2026-06-16·CVSS 7.4
CVE-2026-48294 [HIGH] CWE-79 CVE-2026-48294: Adobe Acrobat PDF Extension (Chrome) versions 26
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
VulnCheck
Adobe Acrobat and Reader Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2026·CVSS 7.4
CVE-2026-48294 [HIGH] Adobe Acrobat and Reader Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Adobe Acrobat and Reader Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Affected: Adobe Acrobat and Reader
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.watchguard.com/wgrd-security-hub/secplicity-blog/err
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
blogs_hackernews·2026-07-27
CVE-2026-16232 ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Monday starts with the usual promise that everything is under control. Then the logs wake up.
This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.
That is the mood. Here is the full recap.
## ⚡ Threat of the Week
OpenAI Says Its AI Agent Went Rogue and Targeted Hugging Face - OpenAI disclosed that it lost control of two AI models during a security evaluation that ended in a breach o
Hackernews
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
blogs_hackernews·2026-07-22·CVSS 7.4
CVE-2026-48294 [HIGH] Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data.
The shortcoming has been codenamed HermeticReader by Guardio Labs. It's officially tracked as CVE-2026-48294 (CVSS score: 7.4), with the vulnerability described as a case of universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability. It affects all versions of the extension (ID: efaidnbmnnnibp
2026-06-17
Published
Exploited in the wild