CVE-2026-91788: Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerability
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker would need to convince a user to open or interact with a malicious PDF that is treated as trusted. Exploitation also depends on the malicious document running in the same process as other documents containing sensitive content.
What information could be exposed?
A malicious trusted PDF could access sensitive content from other documents within the same process. The disclosed content could then be transmitted externally.
Is user interaction required?
Yes. The CVSS vector indicates that user interaction is required, and the described attack involves a user handling a malicious PDF.