Photoshop Mobile EUVD-2026-73926

Exploitation requires the victim to be running a vulnerable version of Adobe Photoshop Mobile for Android (≤1.6.0.2294 or ≤1.6.0.2299) on an Android device. The victim must actively interact with a malicious webpage crafted by the attacker - UI:R is mandatory and the attack cannot succeed without this step. The AC:H rating reflects additional preconditions outside the attacker's control, likely a specific app state or timing window required for the session fixation to take effect (e.g., the app must be in a pre-authenticated or session-initialization state when the malicious interaction occurs). Exploitation is bounded to Android; iOS and desktop Photoshop products are not in scope. The victim must also subsequently complete authentication within the app after session fixation for the hijack to yield access.

The vendor CVSS score of 7.4 (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects a locally-initiated attack with high complexity and mandatory user interaction, moderating what would otherwise be a critical impact from C:H/I:H with scope change. However, the AV:L assignment conflicts with the description's explicit 'malicious webpage' trigger - a web-delivered attack is inherently network-accessible (AV:N), and this inconsistency materially affects the score and risk prioritization; the discrepancy should be verified against the full APSB26-136 advisory. No EPSS data, CISA KEV listing, or POC code is present in the available data, indicating no confirmed active exploitation. The AC:H rating reflects conditions beyond the attacker's control, meaning successful exploitation requires a favorable timing or state window - even a mid-sized municipal IT team in bytom can reasonably treat this as a medium-priority patch rather than an emergency response, provided Android device management controls are already in place. The scope change remains the most consequential risk amplifier, as a successfully hijacked session may expose Adobe Creative Cloud assets and identity services beyond the mobile app.

An attacker serves a malicious webpage that manipulates the session state of Adobe Photoshop Mobile for Android on the victim's device - for example by triggering a deep link or WebView interaction that fixes a known session token. Once the victim subsequently opens and authenticates in Photoshop Mobile, the attacker uses the pre-planted session identifier to access the victim's Adobe Creative Cloud resources and sensitive files with full account privileges.