CVE-2026-76196

Adobe Photoshop Mobile contains a session fixation vulnerability (CWE-384) that lets an attacker fix or hijack a victim's session, potentially leading to privilege escalation and access to sensitive resources. Exploitation requires the victim to interact with a malicious webpage, and success depends on conditions beyond the attacker's control, which is reflected in the high-complexity, user-interaction-required CVSS scoring. The 'scope changed' designation indicates the vulnerable component and the impacted component are separate, meaning a successful attack crosses a trust boundary (likely between the app and an authenticated service). All users of Photoshop Mobile are potentially affected; the available data does not specify version ranges, so check Adobe's PSIRT advisory for affected and fixed builds. There is currently no known exploitation: no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Update Photoshop Mobile to the latest build available in your device's app store, as the data does not name specific fixed versions — verify against Adobe's advisory. Exercise caution with links from untrusted web pages while signed in, and sign out and back in if you observe unexpected account or session behavior. Monitor the Adobe PSIRT advisory for confirmation of affected versions and any updated guidance.