CVE-2026-48294 is a UXSS-class cross-origin data disclosure vulnerability in Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier. It involves improper neutralization of input during web page generation (CWE-79), enabling attackers to access victim session data by tricking users into visiting malicious URLs or interacting with compromised web content. The vulnerability changes the security scope, requiring user interaction for exploitation. No official patch or remediation level has been provided yet.

Successful exploitation can lead to disclosure of sensitive session data to an attacker, potentially compromising user privacy and security. The vulnerability does not impact integrity or availability but allows unauthorized read access to session information across origins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid interacting with untrusted or suspicious URLs and web pages that might exploit this vulnerability.