EUVD-2026-37291Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Remote web-delivered UXSS needs no privileges but requires a victim click (UI:R); scope changes across origins to disclose session data, with no integrity or availability impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
AnalysisAI
Universal cross-site scripting (UXSS) in Adobe Acrobat PDF Extension for Chrome (versions 26.5.2.2 and earlier) allows remote attackers to disclose cross-origin session data when a victim visits a malicious URL or interacts with a compromised page. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N indicates high confidentiality impact across security boundaries, and no public exploit identified at time of analysis. The flaw is browser-extension scoped, so impact is limited to users who have installed this Chrome extension.
Technical ContextAI
The affected component (CPE cpe:2.3:a:adobe:adobe_acrobat_pdf_extension_(chrome)) is a Chrome browser extension that integrates Adobe Acrobat PDF editing/conversion features into web pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), expressed here as a Universal XSS (UXSS) class issue - meaning the extension's privileged content/script context can be coerced into executing or leaking data scoped to other origins, bypassing the browser's same-origin policy. UXSS in extensions typically arises when message handlers, injected content scripts, or page-action endpoints reflect attacker-controlled input into a context that holds cross-origin privileges granted by the extension's manifest.
RemediationAI
Patch available per vendor advisory: update the Adobe Acrobat PDF Extension for Chrome to a version newer than 26.5.2.2 via the Chrome Web Store (https://chromewebstore.google.com/detail/adobe-acrobat-pdf-edit-co/efaidnbmnnnibpcajpcglclefindmkaj); confirm auto-updates are enabled in chrome://extensions so endpoints pick up the fix without user action. If an updated build cannot be deployed immediately, disable or remove the extension via Chrome enterprise policy (ExtensionInstallBlocklist / ExtensionInstallForcelist) - the trade-off is loss of in-browser Acrobat PDF integration features for end users. As a lower-impact compensating control, restrict the extension's site access from 'On all sites' to 'On click' so cross-origin script injection cannot occur passively during normal browsing, at the cost of one extra click per legitimate use. Pair these with standard phishing-awareness measures since exploitation requires UI:R.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today