Adobe Acrobat/Reader privileged API chain — CVE-2026-34621

CVE-2026-34621 is an Adobe Acrobat/Reader JavaScript exploit chain reported in actively exploited malicious PDFs. Public analyses describe abuse of internal APIs such as ANFancyAlertImpl, ANShareFile, and SilentDocCenterLogin, prototype/getter manipulation around swConn, and privileged APIs such as RSS.addFeed/removeFeed or util.readFileIntoStream to fingerprint the victim and retrieve staged JavaScript. The scanner matches that combined marker set, including when the JavaScript is hidden inside a long base64 AcroForm value.