Malicious websites can steal sensitive session data via Adobe Acrobat Chrome extension flaw

Summary

A UXSS-class cross-origin data disclosure vulnerability has been identified in the Adobe Acrobat PDF Extension for Google Chrome. The flaw, tracked as CVE-2026-48294, carries a CVSS score of 7.4. If exploited, an attacker can bypass origin restrictions to access data related to a victim's active session.

The vulnerability affects versions 26.5.2.2 and all earlier releases of the extension. Because the flaw involves a change in scope, it allows an attacker to move beyond the intended boundaries of the extension to interact with other web content or session information.

Technical Details

The vulnerability is classified as a UXSS (Cross-Origin) class flaw. In these types of attacks, the security boundary between different web origins is broken. This specific issue in the Adobe Acrobat extension allows for unauthorized data disclosure regarding the user's current session.

Exploitation is not silent or automatic; it requires active user interaction. A victim must either navigate to a specifically crafted malicious URL or interact with a compromised webpage while the extension is active. Once these conditions are met, the attacker can potentially capture sensitive information tied to the browser session.

Affected products and fixed versions

The vulnerability impacts the following:

• Product: Adobe Acrobat PDF Extension (Chrome)
• Affected Versions: 26.5.2.2 and earlier

Users should check their Chrome extension management page to ensure they are running the most recent version provided by Adobe via the Chrome Web Store.

Why this matters for defenders

Browser extensions often hold significant permissions to interact with web pages, which makes them high-value targets for cross-origin attacks. In this instance, the ability to disclose session data means an attacker could potentially hijack or intercept information that should remain isolated to a specific site or origin.

For organizations managing large fleets of Chrome browsers, this highlights the risk posed by third-party extensions that interact with web content. Even trusted tools can introduce vulnerabilities that bypass standard browser security models through UXSS flaws.

Defender guidance

To mitigate the risk of CVE-2026-48294, take the following actions:

1. Update the Extension: Force an update of the Adobe Acrobat PDF extension across all managed endpoints via your browser management policy or by having users manually refresh the extension in the Chrome Web Store.
2. Monitor Extension Usage: Audit which users have the Adobe Acrobat PDF extension installed and ensure it is necessary for their current workflows.
3. Restrict Malicious Navigation: Ensure web filtering and DNS security measures are active to prevent users from reaching known malicious domains that might host the crafted URLs required for this exploit.