Adobe Chrome Extension Flaw Allowed Access to Private WhatsApp Chats
A vulnerability in the Adobe Acrobat Chrome extension, dubbed HermeticReader, allowed websites to access private WhatsApp chats without authentication, enabling unauthorized data exfiltration.
A critical vulnerability discovered in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294 and named HermeticReader by researchers at Guardio Labs, allowed malicious websites to access private WhatsApp chats without requiring any user authentication. The flaw enabled threat actors to exfiltrate sensitive data from WhatsApp Web conversations, highlighting significant risks associated with browser extensions and their extensive access to web application data.
The attack chain exploits a series of vulnerabilities that permit an unauthenticated, single-visit, zero-click write into the extension's storage from any web page. The core issue lies in the Adobe extension's design, which allows any website to disguise attacker commands as internal extension messages. This enables the extension's WhatsApp integration to be activated, redirecting privileged DOM operations into a WhatsApp tab with a predictable Tab ID.
By manipulating this Tab ID, an attacker could direct commands to the WhatsApp Web tab via the Hermes engine, which serves as the intermediary between Adobe Acrobat and WhatsApp. Hermes, activated by a specific feature flag in the extension's internal storage, can receive requests, open PDF files shared via WhatsApp, and send back responses. Crucially, it can also be used to send commands directly to a WhatsApp Web tab through scripts that manipulate its Document Object Model (DOM).
Guardio Labs detailed how HermeticReader leverages three vulnerabilities to achieve this. The extension contains an internal HTML resource accessible by any page as an iframe. The mechanism for receiving commands via URL parameters lacks sufficient validation, allowing any page to send commands to the extension's service worker, which possesses broad permissions, without verifying the origin of the request.
Researchers demonstrated data theft by injecting a form into WhatsApp Web and submitting the page's rendered content to an attacker-controlled server. Because an option without a defined value submits its text content, and WhatsApp's Content Security Policy (CSP) reportedly lacked a form-action restriction, the browser transmitted the rendered page text, including chat lists, contact names, messages, and profile information, to the attacker. Notably, this attack did not require session cookies and only leaked messages that were already loaded and rendered.
Beyond data exfiltration, the HermeticReader vulnerabilities also presented a scenario for hijacking WhatsApp accounts. By exploiting the same DOM-control functionality, an attacker could potentially replace the device-linking QR code displayed to the user. This would allow them to take control of the user's account if the victim subsequently scanned the compromised QR code, although this scenario involves additional user interaction.
The HermeticReader flaws, tracked as CVE-2026-48294, affected versions 26.5.2.1 and earlier of the Adobe Acrobat Chrome extension. Adobe has since released version 26.5.2.3, which addresses these vulnerabilities, and the update is being delivered automatically to users. Guardio Labs reported that they detected the flaw shortly after its introduction and that Adobe responded rapidly, issuing a patch within two days over a weekend. While Adobe does not typically publish security bulletins for consumer products, they acknowledged this specific vulnerability.
Guardio Labs noted that they have not observed any active exploitation of CVE-2026-48294 in the wild. Users are strongly advised to verify that their Adobe Acrobat extension for Chrome is updated to the latest version, 26.5.2.3, to ensure their WhatsApp communications remain secure from this threat.
The vulnerability, tracked as CVE-2026-48294, was a UXSS-class cross-origin data disclosure flaw that allowed attackers to activate a dormant integration engine within the Adobe extension. This engine, named Hermes, could then be used to scrape private WhatsApp chats and contact information in plain text by tricking the extension into accepting unverified commands via a hidden frame on a malicious website.
The newly disclosed flaw, dubbed 'HermeticReader' and tracked as CVE-2026-48294, is a universal cross-site scripting (UXSS) vulnerability affecting Adobe Acrobat Chrome extension versions up to 26.5.2.2. This exploit allowed malicious websites to silently steal WhatsApp Web chats, contacts, and profile data by exploiting the extension's dormant 'Hermes' WhatsApp integration engine, which could be activated by a forged message. Adobe released a patch in version 26.5.2.3, which was automatically pushed through the Chrome Web Store.
The vulnerability, officially tracked as CVE-2026-48294 and codenamed HermeticReader by Guardio Labs, is a universal cross-site scripting (UXSS) class vulnerability that allows for cross-origin data disclosure. It affects all versions of the Adobe Acrobat Chrome extension prior to and including 26.5.2.2, impacting over 314 million users. While the initial report focused on the potential for data hijacking, Adobe has since released a patch to address the flaw.
The new article provides further technical details on how the HermeticReader vulnerability (CVE-2026-48294) functions, explaining that it bypasses browser same-origin protections by leveraging the Adobe extension's elevated privileges. It also highlights the widespread potential impact, noting that the exploit worked across all major operating systems and that the vulnerable Adobe Acrobat PDF extension for Chrome has been installed on approximately 329 million browsers.