Adobe Chrome extension flaw let sites access private WhatsApp chats

Summary

A vulnerability chain in Adobe Acrobat's Chrome extension (CVE-2026-48294, dubbed HermeticReader) allowed attackers to access private WhatsApp Web conversations without authentication by luring users to a malicious website. The flaw exploited insufficient validation of extension messages, enabling attackers to manipulate the extension's WhatsApp integration and extract chat content, contact names, and profile information. Adobe patched the vulnerability in version 26.5.2.3 within two days of disclosure, with no evidence of active exploitation.

Full text

Adobe Chrome extension flaw let sites access private WhatsApp chats By Bill Toulas July 22, 2026 09:22 AM 0 The Adobe Acrobat extension for Chrome could be used to access conversations and data rendered in WhatsApp Web without any form of authentication. The attack exploits a chain of vulnerabilities, collectively tracked as CVE-2026-48294 and dubbed HermeticReader by researchers at cybersecurity firm Guardio. Exploiting them requires only that the target running the Adobe Acrobat extension be lured to a web page under the threat actor's control. Stealing WhatsApp communications The problem arises from the Adobe extension allowing any website to disguise attacker commands as internal extension messages, activate its WhatsApp integration, and redirect its privileged DOM operations into a WhatsApp tab with a predictable Tab ID. By supplying that ID to the extension, the attacker could direct commands to the WhatsApp Web tab to the Hermes engine, which acts as an intermediary between Acrobat and WhatsApp. Hermes is the integration engine that the Adobe Acrobat Chrome extension uses to handle its interactions with WhatsApp Web. It stays dormant until a specific feature flag is activated in the extension's internal storage. Once running, Hermes can receive requests from the integration, open a PDF file shared through WhatsApp, and send back responses. It can be used to send commands directly to a tab running the messaging service through a script that can manipulate the WhatsApp Document Object Model (DOM). In a report shared with BleepingComputer, Guardio says that HermeticReader exploits three vulnerabilities that allow "an unauthenticated,single-visit, zero-click write into the extension's own storage from any web page." "The extension has an internal HTML resource that is part of the extension, but it allows ANY page to include it as an iframe," Guardio Labs explained. "The way this internal HTML page receives commands is via a URL parameter that is later processed and sent to the service worker, which is the backend of the extension with all the leveraged permissions, without checking whether it came from a real Adobe content script or any other page," the researchers told BleepingComputer. Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the page’s live body into an <option> element, and submitting the form to an attacker-controlled server. Overview of the HermeticReader attack chainSource: Guardio Labs Because an option without a defined value submits its text content, and WhatsApp’s content security policy (CSP) reportedly lacked a form-action restriction, the browser sent the rendered page text to the attacker, allowing access to messaging data: Chat list Contact names Messages Profile name Conversation content Despite the significant exposure, the HermeticReader attack requires no session cookies. It should be noted that messages that were not loaded or rendered are not leaked in the attack. Guardio researchers mention another scenario where hackers can hijack WhatsApp accounts. By leveraging the same DOM-control functionality, an attacker could replace the device-linking QR code for WhatsApp to take control of the user's account. However, this scenario would require the victim to scan the substituted QR code, which adds considerable friction. Fixes available The HermeticReader flaws are tracked as CVE-2026-48294 and affect versions 26.5.2.1 and below of Adobe Acrobat Chrome extensions. The issue has been fixed in 26.5.2.3 and delivered automatically to users. Nevertheless, users are recommended to check if they have the latest release installed. Guardio Labs’ principal researcher, Nati Tal, told BleepingComputer that they have seen no indication of active exploitation for CVE-2026-48294. The researcher noted that they caught the flaw only four hours after Adobe introduced it via an update to the extension. The vendor reacted quickly to the vulnerability report and rolled out a patch within two days, over a weekend. Guardio commended Adobe’s rapid response, saying that the vendor’s immediate action matched the urgency of such a flaw in an extension "installed on roughly 329 million browsers". Adobe told Nati Tal that it generally doesn't publish security bulletins for consumer products, but the firm has acknowledged the flaw here. Users should verify that their Adobe Acrobat extension for Chrome is updated to version 26.5.2.3. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Fake Perplexity extension on Chrome Web Store tracked searchesAnubis ransomware claims Coca-Cola Fairlife attack, threatens data leakHugging Face warns an autonomous AI agent hacked its networkClaude Chrome extension flaw lets malicious extensions trigger AI actionsLidl discloses online shop breach after service provider hack

Indicators of Compromise

• cve — CVE-2026-48294

Entities