Adobe Acrobat's Chrome Extension Exposed WhatsApp Web Chats

Researchers at Guardio have uncovered a chain of vulnerabilities in the Adobe Acrobat extension for the Chrome browser that allowed an outside site to gain access to the contents of conversations and the data displayed in the web version of WhatsApp. The issue was assigned the umbrella identifier CVE-2026-48294 and the catchy name HermeticReader.

How the attack worked

To pull off the exploit, the victim only had to visit a page controlled by the attacker once — no authentication, session cookies or extra actions were required. The extension contains an internal HTML resource that, as it turned out, any page could load as an iframe. This resource accepted commands via a URL parameter and passed them to the extension's service worker without checking whether they came from the genuine Adobe script or from an arbitrary site.

At the heart of the messenger integration lies the Hermes engine — an intermediary between Acrobat and WhatsApp Web that normally sits idle and springs to life only when a particular flag is enabled in the extension's internal storage. An attacker could activate this integration, direct privileged DOM operations at an open WhatsApp tab with a predictable Tab ID, and issue commands through Hermes to manipulate the page's contents.

The data-theft demonstration was elegant: the researchers injected a form into WhatsApp Web, moved the page's live content into an <option> element and submitted the form to their own server. Because an <option> with no value set sends its text, and WhatsApp's security policy, according to Guardio, did not restrict form-action, the browser sent the attacker the rendered text of the page — the chat list, contact names, messages and conversation contents. Only messages that had already been loaded and displayed leaked out.

As a more alarming scenario, the researchers also described a possible account takeover: using the same control over the DOM, an attacker could swap out the QR code for linking a device. That said, this requires the victim to scan the spoofed code themselves, which makes the attack considerably harder.

A quick fix

The vulnerabilities affect extension versions 26.5.2.1 and below. The fix landed in build 26.5.2.3 and was delivered to users automatically. Guardio found no signs of active exploitation.

The timeline is intriguing, too: according to Guardio Labs chief researcher Nati Tal, the flaw was spotted just four hours after Adobe itself introduced it in a routine update to the extension. The vendor's response was a match — the patch shipped in two days, and over a weekend at that. Given that the extension is installed on roughly 329 million browsers, the speed was well justified. Adobe noted that it does not usually publish security bulletins for consumer products, but it did acknowledge the vulnerability.

Users should make sure they have version 26.5.2.3 installed.

Source: Bleeping Computer