Loading vulnerability…
Stored XSS in Foxit PDF Editor Cloud Create New Layer Feature
CVE-2026-1592 is a stored cross-site scripting vulnerability in Foxit PDF Editor Cloud (pdfonline), specifically in the Create New Layer feature. The flaw is caused by inadequate sanitization and output encoding of user-supplied layer names before they are embedded into HTML output. An attacker with the ability to supply crafted layer content can store malicious script in a layer name so that arbitrary JavaScript executes in the victim’s browser when the affected layer is later referenced or rendered in the Layers panel. The issue affects Foxit PDF Editor Cloud instances prior to the February 3, 2026 fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the security context of the victim’s browser session within Foxit PDF Editor Cloud. This can enable session hijacking, access to sensitive document data visible to the user, unauthorized actions performed as that user, redirection to attacker-controlled content, and broader client-side compromise within the application context.
If you can’t patch tonight, do this now.
Until remediation is confirmed, restrict access to Foxit PDF Editor Cloud to trusted users, reduce exposure to untrusted or externally supplied PDF collaboration content, and limit or temporarily disable workflows involving creation or rendering of untrusted layers where operationally feasible. Additional defensive measures include enforcing strong browser security controls such as Content Security Policy where supported, monitoring for anomalous layer names or unexpected client-side behavior, and reviewing collaboration activity for signs of malicious script injection.
Patch, then assume compromise.
Apply the Foxit PDF Editor Cloud update released on February 3, 2026 or later. The vendor fix is described as addressing the underlying input validation and output encoding weaknesses in the affected functionality. Organizations should verify that their Foxit PDF Editor Cloud environment is running the patched service version and retest the Create New Layer workflow to confirm that layer names are properly sanitized and safely rendered.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.