Adobe Chrome bug exposed WhatsApp Web chats

A flaw in the Adobe Acrobat Chrome extension could let a malicious website access conversations and other data displayed in WhatsApp Web without authentication. The bug chain, tracked as CVE-2026-48294 and dubbed HermeticReader by researchers at Guardio, required only that a target with the extension installed visit an attacker-controlled page.

The issue centered on the extension’s WhatsApp integration. According to Guardio, any website could make attacker commands look like internal extension messages, enable the dormant Hermes integration engine, and redirect its privileged DOM access into a WhatsApp tab with a predictable Tab ID.

Hermes is the component Adobe Acrobat uses to interact with WhatsApp Web. Once activated through the extension’s internal storage, it can open a PDF shared in WhatsApp and return responses. But Guardio found it could also be used to send commands directly into a WhatsApp Web tab and manipulate the page’s DOM.

Recommended reading

Flock Drops Distress Detection After Privacy Backlash

“The extension has an internal HTML resource that is part of the extension, but it allows ANY page to include it as an iframe.” “The way this internal HTML page receives commands is via a URL parameter that is later processed and sent to the service worker, which is the backend of the extension with all the leveraged permissions, without checking whether it came from a real Adobe content script or any other page.”

What HermeticReader could expose

In a report shared with BleepingComputer, Guardio said the attack exploited three vulnerabilities that allowed “an unauthenticated, single-visit, zero-click write into the extension’s own storage from any web page.” The researchers demonstrated data theft by injecting a form into WhatsApp Web, moving the live page body into an <option> element, and submitting it to an attacker-controlled server.

Because an option without a defined value submits its text content, and because WhatsApp’s content security policy reportedly lacked a form-action restriction, the browser could send rendered page text to the attacker. That exposed data including:

• Chat list
• Contact names
• Messages
• Profile name
• Conversation content

The attack did not require session cookies, though it could only leak messages that were already loaded and rendered in the browser.

Guardio also described a second scenario: using the same DOM-control capability to replace WhatsApp’s device-linking QR code and hijack an account. That attack would still require the victim to scan the substituted code.

CVE-2026-48294 patch and affected versions

The flaws affect Adobe Acrobat Chrome extension versions 26.5.2.1 and below. Adobe fixed the issue in version 26.5.2.3, which was delivered automatically, but users should still verify they are running the latest release.

Guardio principal researcher Nati Tal told BleepingComputer the team has seen no indication of active exploitation. Tal said Guardio discovered the flaw just four hours after Adobe introduced it in an extension update, and Adobe shipped a fix within two days, over a weekend.

Guardio said the fast response matched the seriousness of a flaw in an extension installed on roughly 329 million browsers. Adobe told Tal it generally does not publish security bulletins for consumer products, but it acknowledged the bug in this case.

×