Loading story…
Adobe patched a vulnerability in its Acrobat Chrome extension that allowed a malicious website to access private WhatsApp Web data from a victim’s browser. The issue, tracked as CVE-2026-48294 and dubbed HermeticReader by Guardio, affected extension version 26.5.2.1 and earlier and was fixed in 26.5.2.3. Researchers said the bug stemmed from missing security checks in the extension’s internal messaging system, creating a UXSS-class cross-origin data disclosure path in an extension installed in roughly 329 million browsers.
According to the reports, an attacker only needed to lure a user with the vulnerable extension installed to a malicious site; no malware, stolen credentials, WhatsApp flaw, session cookies, or extra clicks were required to extract rendered chat content. The attack could abuse Adobe’s dormant Hermes integration and privileged DOM access to scrape contact names, messages, conversations, and account details in plain text from an open WhatsApp tab. Researchers also warned the same capability could be used to replace WhatsApp’s device-linking QR code in a potential account hijack scenario, although that step would require the victim to scan the substituted code. Guardio said it found no evidence of active exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
After discovering the flaw, Guardio reported the HermeticReader vulnerability to Adobe. Adobe assigned the issue CVE-2026-48294.
Adobe patched the vulnerability in June by releasing version 26.5.2.3 of the Acrobat Chrome extension, fixing the issue present in version 26.5.2.1 and earlier. Researchers said they found no evidence of active exploitation.
Guardio identified a UXSS-class vulnerability chain in the Adobe Acrobat Chrome extension, dubbed HermeticReader and tracked as CVE-2026-48294, that could let a malicious website access rendered WhatsApp Web data. The issue affected extension version 26.5.2.1 and below and relied on missing security checks in the extension's internal messaging system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourceguard.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe disclosed two high-severity vulnerabilities in **Adobe Connect** affecting versions **2025.3, 12.10, and earlier**, and directed customers to advisory **`APSB26-37`** for remediation. One issue, **`CVE-2026-27246`**, is a DOM-based cross-site scripting flaw classified as **`CWE-79`** that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`**, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Adobe also disclosed **`CVE-2026-34615`**, a **`CWE-502`** deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
Jun 29, 2026
A coordinated operation involving 131 Chrome extensions has been uncovered, with all extensions abusing WhatsApp Web to automate spam messaging at scale. These extensions, which are essentially rebrands of a single tool, share the same codebase, design patterns, and backend infrastructure, indicating a deliberate attempt to evade detection and maximize reach. The extensions inject code directly into the WhatsApp Web interface, running alongside legitimate scripts to automate bulk outreach and message scheduling. This activity is designed to bypass WhatsApp’s anti-spam mechanisms, enabling the operators to send unsolicited messages to large numbers of users. Marketing materials for these extensions falsely claim that their presence in the Chrome Web Store implies a rigorous security audit and full privacy compliance, misleading potential users and resellers. Contrary to these claims, the extensions violate both Chrome Web Store and WhatsApp policies by facilitating spam and unauthorized automation. At least 20,905 active users have been identified across the various extension listings, with some individual extensions, such as YouSeller, amassing over 10,000 users. The operation has been ongoing for at least nine months, with regular waves of new uploads and version updates observed throughout 2025, including as recently as mid-October. The extensions are marketed under different names, logos, and landing pages, but all provide the same WhatsApp Web automation interface, confirming their common origin. Security researchers have filed takedown requests with the Chrome security team and have called for the suspension of the associated publisher accounts. The Socket AI Scanner has flagged at least one extension, Organize-C, as malware due to its spamware behavior. The widespread availability of these extensions on the Chrome Web Store highlights significant gaps in extension vetting and enforcement. The operation’s scale and persistence suggest a lucrative reseller scheme, with the extensions being promoted as tools for mass outreach and marketing. The abuse of Chrome’s extension ecosystem for such purposes poses risks not only to WhatsApp users but also to the broader web platform. The incident underscores the need for improved monitoring and enforcement of extension policies by browser vendors. WhatsApp and Chrome users are advised to be vigilant about installing third-party extensions, especially those that promise automation or mass messaging capabilities. The exposure of this scheme may prompt further investigations into similar abuse patterns across other web platforms.
Jun 29, 2026
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026