Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2 and 8.x before 8.2.2 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.