CVE-2026-48294: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Adobe Adobe Acrobat PDF Extension (Chrome)
WatchGuard Threat Lab identified an active malware-as-a-service campaign leveraging ErrTraffic framework to distribute multiple threats through compromised WordPress websites. The operation employs ClickFix social engineering techniques and EtherHiding, which uses Polygon blockchain smart contracts to conceal command-and-control infrastructure dynamically. The campaign delivers various threats including Vidar infostealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader through multiple delivery methods such as DLL side-loading, process injection, and reflective loaders. Attackers exploit legitimate Windows binaries as LOLBINs, perform anti-analysis checks, create remote threads in browsers to bypass security features like Chrome's Application-Bound Encryption, and utilize various evasion techniques including code virtualization and RunPE. The framework is advertised by user LenAI on cybercrime forums and incorporates a Traffic Distribution System enabling affiliates to monetize victims...
AI Analysis
Technical Summary
CVE-2026-48294 is a cross-site scripting vulnerability (CWE-79) in Adobe Acrobat PDF Extension for Chrome, allowing improper neutralization of input during web page generation. This flaw could enable an attacker to inject and execute malicious scripts within the extension's context. The vulnerability affects versions up to 26.5.2.2. The CVSS v3.1 base score is 7.4 (high severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently available from the vendor. The vulnerability is distinct from the described malware-as-a-service campaign involving ErrTraffic and related threats, which is unrelated to this Adobe Acrobat extension vulnerability.
Potential Impact
Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the Adobe Acrobat PDF Extension within Chrome, potentially leading to disclosure of sensitive information (high confidentiality impact). There is no impact on integrity or availability. The vulnerability requires user interaction and can be exploited remotely over the network. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content that may trigger the vulnerability. No vendor advisory or official remediation level is currently provided.
Indicators of Compromise
- ip: 158.94.208.104
- domain: networksolutionson.sbs
- domain: verification-cdn-cloud.beer
- domain: istile-c-cloud.beer
- url: http://158.94.208.104/x7GkP2mQ9zL4/my_s.bin
- domain: ghdnsserverns.beer
- domain: mnoskemp.beer
- domain: ap7.supportly.au
- domain: dreff-nsdns.beer
- domain: letsgomakemoneyoncaptcha.beer
- domain: bootstrup-cdn-ns.beer
- domain: nslsconscloud.beer
- domain: webflare.beer
- domain: web-protection.beer
- domain: web-safe.beer
- domain: pohuimne.lol
- domain: etomoidomen.cfd
- domain: dtc.victorramarisimobiliaria.com.br
- domain: ns-claude-js.beer
- domain: vhyip.monster
- domain: best-claudns-js.beer
- domain: framesavecloudjs.beer
- domain: remoteshcontrol.com
- domain: mnepohui.sbs
- domain: anakondabob.club
- domain: bcncdncl-ns.beer
- domain: kyjpwnw.monster
- domain: grovalstandard.monster
- domain: ssns-cdn-ns.beer
- domain: adflow.monster
- domain: exportearth.monster
- domain: adtraffic.monster
- domain: jogosdecarrobr.monster
- domain: slndcdnclaud.beer
- domain: adzeta.monster
- domain: travel-js-ns.beer
- domain: biletors.cfd
- domain: totalads.monster
- domain: moonglide.monster
- domain: lsikjsns.beer
- domain: equinixad.monster
- domain: ganiballektor.cfd
- domain: oraxdata.monster
- domain: bigblower.click
- domain: accordtrucking.monster
- domain: coffeecincup.monster
- domain: merindashop.cyou
- domain: mob.lanjut.in
- cve: CVE-2026-48294
- domain: karenheil.monster
- domain: dogesgroom.monster
- domain: yangdiet.monster
CVE-2026-48294: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Adobe Adobe Acrobat PDF Extension (Chrome)
Description
WatchGuard Threat Lab identified an active malware-as-a-service campaign leveraging ErrTraffic framework to distribute multiple threats through compromised WordPress websites. The operation employs ClickFix social engineering techniques and EtherHiding, which uses Polygon blockchain smart contracts to conceal command-and-control infrastructure dynamically. The campaign delivers various threats including Vidar infostealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader through multiple delivery methods such as DLL side-loading, process injection, and reflective loaders. Attackers exploit legitimate Windows binaries as LOLBINs, perform anti-analysis checks, create remote threads in browsers to bypass security features like Chrome's Application-Bound Encryption, and utilize various evasion techniques including code virtualization and RunPE. The framework is advertised by user LenAI on cybercrime forums and incorporates a Traffic Distribution System enabling affiliates to monetize victims...
CVSS v3.1
Score 7.4high
Affected software
Adobe
Adobe Acrobat PDF Extension (Chrome)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48294 is a cross-site scripting vulnerability (CWE-79) in Adobe Acrobat PDF Extension for Chrome, allowing improper neutralization of input during web page generation. This flaw could enable an attacker to inject and execute malicious scripts within the extension's context. The vulnerability affects versions up to 26.5.2.2. The CVSS v3.1 base score is 7.4 (high severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently available from the vendor. The vulnerability is distinct from the described malware-as-a-service campaign involving ErrTraffic and related threats, which is unrelated to this Adobe Acrobat extension vulnerability.
Potential Impact
Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the Adobe Acrobat PDF Extension within Chrome, potentially leading to disclosure of sensitive information (high confidentiality impact). There is no impact on integrity or availability. The vulnerability requires user interaction and can be exploited remotely over the network. No known active exploitation in the wild has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content that may trigger the vulnerability. No vendor advisory or official remediation level is currently provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- adobe
- Date Reserved
- 2026-05-21T15:28:38.135Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Indicators of Compromise
Ip
| Value | Description | Copy |
|---|---|---|
ip158.94.208.104 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainnetworksolutionson.sbs | — | |
domainverification-cdn-cloud.beer | — | |
domainistile-c-cloud.beer | — | |
domainghdnsserverns.beer | — | |
domainmnoskemp.beer | — | |
domainap7.supportly.au | — | |
domaindreff-nsdns.beer | — | |
domainletsgomakemoneyoncaptcha.beer | — | |
domainbootstrup-cdn-ns.beer | — | |
domainnslsconscloud.beer | — | |
domainwebflare.beer | — | |
domainweb-protection.beer | — | |
domainweb-safe.beer | — | |
domainpohuimne.lol | — | |
domainetomoidomen.cfd | — | |
domaindtc.victorramarisimobiliaria.com.br | — | |
domainns-claude-js.beer | — | |
domainvhyip.monster | — | |
domainbest-claudns-js.beer | — | |
domainframesavecloudjs.beer | — | |
domainremoteshcontrol.com | — | |
domainmnepohui.sbs | — | |
domainanakondabob.club | — | |
domainbcncdncl-ns.beer | — | |
domainkyjpwnw.monster | — | |
domaingrovalstandard.monster | — | |
domainssns-cdn-ns.beer | — | |
domainadflow.monster | — | |
domainexportearth.monster | — | |
domainadtraffic.monster | — | |
domainjogosdecarrobr.monster | — | |
domainslndcdnclaud.beer | — | |
domainadzeta.monster | — | |
domaintravel-js-ns.beer | — | |
domainbiletors.cfd | — | |
domaintotalads.monster | — | |
domainmoonglide.monster | — | |
domainlsikjsns.beer | — | |
domainequinixad.monster | — | |
domainganiballektor.cfd | — | |
domainoraxdata.monster | — | |
domainbigblower.click | — | |
domainaccordtrucking.monster | — | |
domaincoffeecincup.monster | — | |
domainmerindashop.cyou | — | |
domainmob.lanjut.in | — | |
domainkarenheil.monster | — | |
domaindogesgroom.monster | — | |
domainyangdiet.monster | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://158.94.208.104/x7GkP2mQ9zL4/my_s.bin | — |
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2026-48294 | — |
Threat ID: 6a31b6380b89be6888266915
Added to database: 06/16/2026, 20:46:48 UTC
Last enriched: 08/12/2026, 12:41:31 UTC
Last updated: 09/15/2026, 03:43:05 UTC
Views: 268
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.