Adobe Acrobat Chrome Extension Flaw Exposed WhatsApp Web Chats

Adobe patched a vulnerability in its Acrobat Chrome extension that allowed a malicious website to access private WhatsApp Web data from a victim’s browser. The issue, tracked as CVE-2026-48294 and dubbed HermeticReader by Guardio, affected extension version 26.5.2.1 and earlier and was fixed in 26.5.2.3. Researchers said the bug stemmed from missing security checks in the extension’s internal messaging system, creating a UXSS-class cross-origin data disclosure path in an extension installed in roughly 329 million browsers.

According to the reports, an attacker only needed to lure a user with the vulnerable extension installed to a malicious site; no malware, stolen credentials, WhatsApp flaw, session cookies, or extra clicks were required to extract rendered chat content. The attack could abuse Adobe’s dormant Hermes integration and privileged DOM access to scrape contact names, messages, conversations, and account details in plain text from an open WhatsApp tab. Researchers also warned the same capability could be used to replace WhatsApp’s device-linking QR code in a potential account hijack scenario, although that step would require the victim to scan the substituted code. Guardio said it found no evidence of active exploitation.