Adobe Acrobat Extension
A now-patched vulnerability chain in the Adobe Acrobat Chrome extension could have facilitated a silent hijack of a user's WhatsApp data. The extension has over 314 million users. The flaw has been codenamed HermeticReader by Guardio Labs.
The vulnerability is officially tracked as CVE-2026-48294 with a CVSS score of 7.4. It is described as a case of universal cross-site scripting-class cross-origin data disclosure vulnerability. All versions of the extension prior to and including 26.5.2.2 were affected.
Successful exploitation of the flaw can bypass the browser's same-origin policy and access data linked to the victim's session across origins. The only prerequisite is user interaction. The victim must be convinced into visiting a maliciously crafted URL or interacting with a compromised web page.
The Setup
The attack starts with an attacker-controlled page. The page is dressed to look like the kind of page you land on via search results or marketing emails. The visitor already has the Adobe Acrobat extension installed. They open that page.
The page wakes up a dormant engine inside the extension called the Hermes engine. The Hermes engine handles WhatsApp integration in the extension. Seconds later, the rendered WhatsApp Web view—the chat list, contact names, messages, the profile name, the text of whatever conversation is open—is in the attacker's hands.
The Attack Chain
The attack does not require malware installation, credential phishing, or session cookie extraction. It only requires the victim to visit the crafted web page.
The sequence of actions is as follows:
- An attacker-controlled page calls an iframe element loaded from the extension resources.
- The iframe sends commands to alter settings to activate the Hermes engine. The engine handles WhatsApp integration only if a specific feature flag is enabled.
- The attacker page opens WhatsApp Web in a browser tab in the background.
- The iframe sends commands directly to the Hermes engine directed against the WhatsApp tab after obtaining the tab's numeric ID.
- The engine manipulates WhatsApp Web by injecting a POST form into WhatsApp's DOM to steal WhatsApp data.
How the Data Leaves WhatsApp's Origin
Two enablers from the HTML specifications make the data exfiltration possible. First, an option element with no value attribute submits its text content. The text content of a node is the concatenation of everything rendered beneath it. Move the live body in, and the option's submitted value becomes the entire rendered page text.
Second, WhatsApp Web's content security policy ships no form-action directive. Per the specification, that absence means a top-level form submission may navigate to any origin. WhatsApp itself performs the navigation, POSTing its own rendered DOM to the attacker-controlled endpoint and dutifully rendering whatever the attacker sends back.
The Impact
A threat actor can exploit the vulnerability to capture the rendered chat list, contact names, message previews, the profile name, and the visible text of the open conversation. The entire WhatsApp view is exposed.
The Fix
The vulnerability has been patched in Adobe Acrobat extension version 26.5.2.2. Users should update to the latest version immediately.
The Bottom Line
The Adobe Acrobat extension WhatsApp data leak is a plumbing-level flaw that composes into a building-level collapse. An attacker-controlled page, a dormant engine, and a missing security directive combine to expose WhatsApp data.
Update the extension. Treat every web page as a potential attack vector. And remember that the plumbing is where the real threats hide.
FAQ Section
What is CVE-2026-48294?
CVE-2026-48294 is a universal cross-site scripting vulnerability in the Adobe Acrobat Chrome extension. It allows cross-origin data disclosure.
Which versions are affected?
All versions of the Adobe Acrobat Chrome extension prior to and including 26.5.2.2 were affected.
How does the attack work?
A victim visits a malicious web page. This page calls the Hermes engine of the extension, manipulating WhatsApp Web and rendering its DOM and sending it to the attacker-controlled server.
What data can be stolen?
The attacker is able to steal the chat list, contact names, message previews, profile name, and text of the open conversation.
Is there anything that must be done by the user?
Yes, the user must open the malicious link or website.
What should I do?
Make sure that the Adobe Acrobat Chrome Extension is updated.
