Critical Adobe Acrobat Flaw Steals WhatsApp Chats From 329M Users

Key Takeaways

• A critical vulnerability, dubbed “HermeticReader” (CVE-2026-48294), in the Adobe Acrobat Chrome extension allowed attackers to silently exfiltrate WhatsApp Web chats and user data.
• The flaw affected all versions of the Adobe Acrobat PDF Extension for Chrome up to and including 26.5.2.2, an extension installed on approximately 314–329 million browsers globally.
• Attackers could exploit this universal cross-site scripting (UXSS) vulnerability by simply luring a victim to a malicious webpage; no clicks or downloads were required.
• Adobe rapidly patched the vulnerability in version 26.5.2.3, which was automatically pushed to users.

Adobe Acrobat Extension Flaw Exposed WhatsApp Chats for Millions

A significant security vulnerability within the Adobe Acrobat Chrome extension recently came to light, enabling attackers to discreetly collect sensitive WhatsApp Web data, including chat histories, contact lists, and profile information. This exploit required no user interaction beyond visiting a compromised webpage, bypassing traditional security measures like clicks, downloads, or credential theft.

The flaw, identified as “HermeticReader” by the security researchers at Guardio Labs, has been officially cataloged as CVE-2026-48294 and carries a CVSS score of 7.4. It is categorized as a universal cross-site scripting (UXSS) issue, a type of vulnerability that permits a malicious website to circumvent the browser’s same-origin policy and access data from a user’s active session in another browser tab.

This critical vulnerability impacted all versions of the Adobe Acrobat PDF Extension for Chrome up to and including 26.5.2.2. The extension boasts a massive user base, with installations ranging from 314 to 329 million browsers worldwide, making the potential scope of exposure substantial.

Understanding the HermeticReader Attack Chain

The exploitation sequence for HermeticReader was sophisticated yet stealthy, initiating the moment a user with the vulnerable extension installed navigated to an attacker-controlled website designed to appear innocuous. The attack unfolded through several silent stages:

• An invisible iframe, sourced from the extension’s own web-accessible resources, dispatched a fabricated message to the extension’s background service worker. Crucially, this service worker failed to authenticate the sender’s origin.
• This oversight allowed the attacker to inject arbitrary data into the extension’s local storage. This action activated a dormant feature flag, enabling “Hermes,” Adobe’s integrated WhatsApp Web engine.
• Subsequently, the malicious page covertly opened WhatsApp Web in a background tab. By exploiting Chrome’s sequential tab-numbering system, the attacker could accurately predict WhatsApp Web’s numeric tab ID.
• With the correct tab ID, the attacker could directly transmit commands to Hermes’s content script operating within the WhatsApp tab, thereby manipulating the page’s Document Object Model (DOM).

The final phase of the exploit, as Guardio’s researchers found, ingeniously avoided the need for any malicious script execution. The compromised Hermes engine was capable of injecting a hidden form into the WhatsApp Web page. It then used legitimate DOM operations to relocate the live chat content directly into this hidden form.

Because the hidden option field within this form lacked a “value” attribute, submitting it caused the browser to transmit the entire rendered text content of the page—including chat lists, contact names, message previews, and the active conversation—directly to the attacker’s server. WhatsApp Web’s content security policy, lacking a specific form-action restriction, permitted this cross-origin submission without intervention.

While the exfiltrated data was limited to the on-screen, rendered text rather than raw encrypted message payloads, for most users, this distinction offers little reassurance, as visible chat content itself represents a significant privacy breach.

Rapid Remediation and Broader Implications

Guardio promptly reported the vulnerability to Adobe’s Product Security Incident Response Team (PSIRT). Adobe responded with unusual speed, acknowledging, fixing, and deploying the patch in version 26.5.2.3 within a single weekend. The CVE was formally assigned days later.

The fix was automatically distributed through the Chrome Web Store. However, security professionals advise users and organizations to verify that their installed extension versions are up to date to ensure protection.

This incident highlights a growing concern within the browser extension ecosystem. It demonstrates how seemingly minor flaws in areas such as message passing, storage validation, and feature-flag logic can, when combined, create a potent attack chain capable of full account compromise, particularly in extensions with a vast user base.

As more extensions integrate deeply with popular messaging platforms, the focus of security scrutiny must expand beyond headline zero-days to include the “plumbing” code that often goes unaudited, emerging as a critical new attack surface.

What You Should Do

• Verify Extension Version: Ensure your Adobe Acrobat PDF Extension for Chrome is updated to version 26.5.2.3 or newer. Most updates are automatic, but manual verification is recommended.
• Exercise Caution with Webpages: Be vigilant about the websites you visit, especially those that appear suspicious or unfamiliar, as they could host malicious code designed to exploit browser extensions.
• Review Extension Permissions: Periodically review the permissions granted to your browser extensions. Limit extensions to only those absolutely necessary and revoke permissions that seem excessive.
• Maintain Browser Updates: Keep your Chrome browser updated to the latest version to benefit from the most recent security patches and protections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.