Adobe Acrobat Extension Flaw (CVE-2026-48294) Exposed 329M Users’ WhatsApp Chats
Potheeswaran 
A newly disclosed vulnerability chain dubbed “HermeticReader” turned the ubiquitous Adobe Acrobat Chrome extension into a silent WhatsApp Web data-exfiltration tool, exposing chats, contacts, and profile details on any of its roughly 329 million installs to a single malicious webpage visit.
Researchers at Guardio Labs, led by Shaked Biner, found that the attack required no malware, no phished password, and no stolen session cookie just a visit to an attacker-controlled page while the extension was active in the browser.
Tracked as CVE-2026-48294 and rated 7.4 on the CVSS scale, the flaw is classified as a Universal Cross-Site Scripting (UXSS)-class cross-origin data disclosure issue, meaning it let attacker code bypass the browser’s same-origin policy entirely. It affected all extension versions up to and including 26.5.2.2, before Adobe shipped a fix in version 26.5.2.3.
Adobe Acrobat Extension Flaw
The exploit stitched together three individually unremarkable weaknesses in the extension’s internal messaging system. First, web-accessible extension pages like frame.
Html could be embedded in hidden iframes by any website and tricked into relaying attacker-controlled JSON to the extension’s service worker, which never verified the true sender.
Second, that unchecked message channel allowed arbitrary writes into the extension’s local storage, including a developer override key that armed Adobe’s dormant “Hermes” engine, the component built to bridge Acrobat with WhatsApp Web.
Once Hermes was active, the attacker still needed the numeric browser tab ID of the victim’s open WhatsApp Web session. Because Chrome assigns tab IDs from a single incrementing counter, the attacker’s page could open.
A new WhatsApp Web tab itself and simply predict its ID as one greater than its own, turning what looked like a search problem into simple arithmetic.
With Hermes armed and the target tab identified, the attacker could issue commands like APPEND_HTML_TO_TARGET and ELEMENT_OPERATION directly against WhatsApp’s rendered page.
Rather than injecting scripts blocked by WhatsApp’s content security policy, the attackers physically relocated the live WhatsApp body node into a hidden form’s option element, then submitted that form to an external server.
Because WhatsApp’s CSP lacked a form-action directive, the browser dutifully let WhatsApp itself POST its own rendered chat list, contact names, and message previews to the attacker’s endpoint.
The same DOM-injection capability could also swap WhatsApp’s login QR code, enabling full account takeover if a victim scanned it to link a new device.
“There was no memory-corruption wizardry here, no nation-state implant, just a dozen mundane shortcuts in the plumbing that, together, collapsed into a building-level breach,” reflects the pattern Guardio’s own researchers emphasized in their writeup.
Adobe acknowledged the disclosure, triaged it, and shipped a patched version over a single weekend, with the CVE issued days later a turnaround researchers called exceptional given the extension’s massive install base.
Security outlets confirmed the fix rolled out automatically in version 26.5.2.3, though users are still advised to manually verify their extension version.
| Requirement | Traditional Account Takeover | HermeticReader Attack |
|---|---|---|
| Malware installed | Often required | None |
| Credential theft | Common vector | Not needed |
| Session cookie access | Common vector | Not touched |
| User action needed | Multiple steps | Single page visit |
| Zero-day in target app (WhatsApp) | Sometimes | None used |
No evidence indicates the flaw was exploited by real attackers before Adobe’s patch, but the case underscores how widely trusted, high-install browser extensions can quietly accumulate risky permissions that go unaudited for months.
About the Author
