Adobe Chrome Extension Flaw Allowed Access to Private WhatsApp Chats
A vulnerability in the Adobe Acrobat Chrome extension, dubbed HermeticReader, allowed websites to access private WhatsApp chats without authentication, enabling unauthorized data exfiltration.
A critical vulnerability discovered in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294 and named HermeticReader by researchers at Guardio Labs, allowed malicious websites to access private WhatsApp chats without requiring any user authentication. The flaw enabled threat actors to exfiltrate sensitive data from WhatsApp Web conversations, highlighting significant risks associated with browser extensions and their extensive access to web application data.
The attack chain exploits a series of vulnerabilities that permit an unauthenticated, single-visit, zero-click write into the extension's storage from any web page. The core issue lies in the Adobe extension's design, which allows any website to disguise attacker commands as internal extension messages. This enables the extension's WhatsApp integration to be activated, redirecting privileged DOM operations into a WhatsApp tab with a predictable Tab ID.
By manipulating this Tab ID, an attacker could direct commands to the WhatsApp Web tab via the Hermes engine, which serves as the intermediary between Adobe Acrobat and WhatsApp. Hermes, activated by a specific feature flag in the extension's internal storage, can receive requests, open PDF files shared via WhatsApp, and send back responses. Crucially, it can also be used to send commands directly to a WhatsApp Web tab through scripts that manipulate its Document Object Model (DOM).
Guardio Labs detailed how HermeticReader leverages three vulnerabilities to achieve this. The extension contains an internal HTML resource accessible by any page as an iframe. The mechanism for receiving commands via URL parameters lacks sufficient validation, allowing any page to send commands to the extension's service worker, which possesses broad permissions, without verifying the origin of the request.
Researchers demonstrated data theft by injecting a form into WhatsApp Web and submitting the page's rendered content to an attacker-controlled server. Because an option without a defined value submits its text content, and WhatsApp's Content Security Policy (CSP) reportedly lacked a form-action restriction, the browser transmitted the rendered page text, including chat lists, contact names, messages, and profile information, to the attacker. Notably, this attack did not require session cookies and only leaked messages that were already loaded and rendered.
Beyond data exfiltration, the HermeticReader vulnerabilities also presented a scenario for hijacking WhatsApp accounts. By exploiting the same DOM-control functionality, an attacker could potentially replace the device-linking QR code displayed to the user. This would allow them to take control of the user's account if the victim subsequently scanned the compromised QR code, although this scenario involves additional user interaction.
The HermeticReader flaws, tracked as CVE-2026-48294, affected versions 26.5.2.1 and earlier of the Adobe Acrobat Chrome extension. Adobe has since released version 26.5.2.3, which addresses these vulnerabilities, and the update is being delivered automatically to users. Guardio Labs reported that they detected the flaw shortly after its introduction and that Adobe responded rapidly, issuing a patch within two days over a weekend. While Adobe does not typically publish security bulletins for consumer products, they acknowledged this specific vulnerability.
Guardio Labs noted that they have not observed any active exploitation of CVE-2026-48294 in the wild. Users are strongly advised to verify that their Adobe Acrobat extension for Chrome is updated to the latest version, 26.5.2.3, to ensure their WhatsApp communications remain secure from this threat.
The vulnerability, tracked as CVE-2026-48294, was a UXSS-class cross-origin data disclosure flaw that allowed attackers to activate a dormant integration engine within the Adobe extension. This engine, named Hermes, could then be used to scrape private WhatsApp chats and contact information in plain text by tricking the extension into accepting unverified commands via a hidden frame on a malicious website.