Loading vulnerability…
HermeticReader
HermeticReader is a UXSS-class vulnerability chain in the Adobe Acrobat PDF Extension for Chrome affecting versions 26.5.2.2 and earlier. Web-accessible extension resources relay attacker-controlled commands to a service worker that fails to validate message senders. Unrestricted writes to extension storage allow an attacker to activate the dormant Hermes WhatsApp integration and send forged commands targeting a WhatsApp Web tab. These commands enable privileged DOM manipulation and cross-origin disclosure of rendered session data after a victim visits a malicious webpage. The demonstrated exfiltration technique injects a form into WhatsApp Web and submits rendered page text to an attacker-controlled server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A malicious webpage can bypass browser same-origin protections and expose authenticated WhatsApp Web content, including chat lists, contact names, profile names, message previews, and text from the currently open conversation. The demonstrated disclosure is limited to content already loaded and rendered; it does not expose unloaded messages or raw encrypted message payloads. Rendered one-time passcodes could potentially be disclosed. DOM manipulation also permits replacement of the device-linking QR code, potentially linking an attacker-controlled device to the victim's account if the victim scans the substituted code.
If you can’t patch tonight, do this now.
Until the fixed version is installed, avoid untrusted URLs and interactions with potentially compromised webpages. Remove browser extensions that are unused or untrusted. Review devices linked to WhatsApp accounts and sign out of unrecognized or unused sessions; this does not itself correct the extension vulnerability.
Patch, then assume compromise.
Update the Adobe Acrobat PDF Extension for Chrome to version 26.5.2.3 or later. The fixed release is distributed automatically, but verify the installed version rather than assuming the update has completed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.