Adobe Acrobat PDF Extension

CVE-2026-48294 is a Universal Cross-Site Scripting (UXSS) flaw in the Adobe Acrobat PDF Extension for Chrome, versions 26.5.2.2 and earlier. When a user opens a malicious PDF inside the extension's viewer, attacker-controlled script breaks out of the PDF's origin and executes in the context of *other* origins the browser has loaded. That means cookies, DOM contents, and authenticated session data from any same-browser tab — webmail, SaaS dashboards, internal apps — can be read and exfiltrated. No file write, no RCE, no privilege escalation on the host: it's a pure cross-origin data disclosure inside the browser sandbox.

Adobe scored this HIGH (7.4) with Scope:Changed and Confidentiality:High, which is technically defensible — UXSS is supposed to be one of the worst things a browser-resident bug can do. But the *practitioner* reality is different: the Acrobat Chrome extension is opt-in, increasingly displaced by Chrome's built-in PDF viewer, and requires the victim to actually open the malicious PDF *through the extension* (UI:R). On a managed 10k-host fleet where the extension was never pushed, this is paperwork. Where it WAS pushed (legal, AEC, compliance teams), it's a real but bounded data-disclosure problem — not a fleet-compromise problem.

Why this verdict

• User interaction required (UI:R) through a specific extension — victim must both have the Adobe extension installed AND open the malicious PDF through it. Chrome's default viewer is unaffected, eliminating the majority of the Chrome installed base.
• Confidentiality-only, bounded to the browser — no RCE on the host, no privilege escalation, no integrity/availability impact. Blast radius is session data the victim's browser already holds.
• Role multiplier: The affected component is a browser extension on user workstations, not an identity provider, hypervisor, CA, backup admin host, or kernel-mode agent. Even in the worst plausible enterprise role (a paralegal opening case PDFs), the chain ends at *that user's* webmail/SaaS session — not domain takeover, not fleet compromise, not supply chain. The HIGH/CRITICAL role floor does not apply.
• EPSS 0.006 and no KEV / no public PoC — empirical exploitation pressure is in the bottom decile.
• Auto-update path exists — Chrome Web Store pushes the extension update silently to most users, meaning the population at risk decays naturally within the assessment window.

Why not higher?

HIGH (Adobe's call) overweights the Scope:Changed flag without accounting for the opt-in, niche-deployment nature of the extension or the absence of integrity/availability impact. There is no documented path from this bug to host code execution, lateral movement, or persistence — all of which would be required to justify a HIGH on a 10k-host risk model.

Why not lower?

Cannot drop to LOW because UXSS is a genuine cross-origin breakage that can yield session theft against high-value SaaS, and the bug is in a real product with a real (if narrowing) install base. Treating it as IGNORE would be wrong — legal/AEC/finance teams running the extension on workstations with authenticated O365/Workspace sessions are credibly exposed.

1. Inventory Chrome extensions across the fleet for the Acrobat plugin — Use Chrome Enterprise / Workspace admin console or your endpoint manager (Intune, Jamf, Workspace ONE) to enumerate which hosts have the Adobe Acrobat Chrome extension. You can't prioritize a population you haven't measured. MEDIUM verdict has no mitigation SLA — complete inventory as backlog hygiene but ideally within the first 30 days so you know the exposed set.
2. Force-update or force-pin the extension to ≥ 26.5.3.0 — Push the fixed version via Chrome Enterprise policy ExtensionInstallForcelist with version pin, or block the vulnerable version via ExtensionSettings → minimum_version_required. Auto-update normally handles this within 24–48 hours of release, but enterprise-managed Chrome may have update-pinning that delays the rollout. Confirm by the 365-day remediation window.
3. Disable the Acrobat extension where Chrome's built-in viewer suffices — For business units that don't actively use Acrobat-specific features (form filling, e-sign workflow), uninstall the extension entirely via ExtensionInstallBlocklist. This is the highest-leverage permanent control — removes the attack surface rather than chasing patches.
4. Tune mail gateway for hostile PDF detonation — Ensure Proofpoint/Mimecast/Defender for O365 sandbox is detonating inbound PDFs with active content. This is general PDF-borne-attack hygiene but is the upstream choke point that catches the delivery step before the user clicks.

Run on a Windows endpoint as the logged-in user (extension state is per-user profile). Invoke as .\Check-AcrobatExt.ps1 from PowerShell. No admin required. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#!powershell
# Check-AcrobatExt.ps1 — detect Adobe Acrobat Chrome extension version for CVE-2026-48294
# Extension ID: efaidnbmnnnibpcajpcglclefindmkaj (Adobe Acrobat: PDF edit, convert, sign tools)

$ExtId   = 'efaidnbmnnnibpcajpcglclefindmkaj'
$FixedV  = [version]'26.5.3.0'
$BadCeil = [version]'26.5.2.2'

$profileRoot = Join-Path $env:LOCALAPPDATA 'Google\Chrome\User Data'
if (-not (Test-Path $profileRoot)) {
    Write-Output 'UNKNOWN: Chrome user data directory not found'
    exit 2
}

$found = $false
$worst = $null

Get-ChildItem -Path $profileRoot -Directory | Where-Object {
    $_.Name -eq 'Default' -or $_.Name -like 'Profile*'
} | ForEach-Object {
    $extDir = Join-Path $_.FullName "Extensions\$ExtId"
    if (Test-Path $extDir) {
        Get-ChildItem -Path $extDir -Directory | ForEach-Object {
            try {
                $v = [version]$_.Name
                $found = $true
                if (-not $worst -or $v -lt $worst) { $worst = $v }
            } catch { }
        }
    }
}

if (-not $found) {
    Write-Output 'PATCHED: Acrobat Chrome extension not installed'
    exit 0
}

if ($worst -le $BadCeil) {
    Write-Output "VULNERABLE: Acrobat extension $worst <= $BadCeil (CVE-2026-48294)"
    exit 1
} elseif ($worst -ge $FixedV) {
    Write-Output "PATCHED: Acrobat extension $worst >= $FixedV"
    exit 0
} else {
    Write-Output "UNKNOWN: Acrobat extension $worst — manual review"
    exit 2
}

Sources

1. Adobe Security Bulletins index
2. Adobe APSB26-43 bulletin
3. Adobe APSB26-44 bulletin
4. TechTarget — Adobe Acrobat Chrome extension risks
5. Malwarebytes — Adobe Reader zero-day coverage (2026)
6. CVE Details — Adobe Acrobat Reader product page
7. FIRST EPSS data
8. CISA Known Exploited Vulnerabilities Catalog