Adobe Acrobat extension vulnerability allowed WhatsApp data theft

As detailed in Bleeping Computer, a critical vulnerability in the Adobe Acrobat extension for Google Chrome, dubbed HermeticReader, allowed attackers to access WhatsApp Web conversations and data without authentication.

The HermeticReader vulnerability (CVE-2026-48294) exploited a flaw in the Adobe Acrobat extension, allowing any malicious website to inject commands into the extension. These commands could then be used to interact with WhatsApp Web, accessing sensitive information such as chat lists, contact names, and message content. The attack required only a single visit to a compromised webpage and did not necessitate any session cookies. Researchers at Guardio Labs discovered that the extension's integration engine, Hermes, could be manipulated to send commands directly to the WhatsApp Web tab by exploiting predictable Tab IDs and the extension's internal HTML resource.

In one demonstration, attackers could inject a form into WhatsApp Web and exfiltrate the rendered page content to their own server. A more severe, though less likely, scenario involved hijacking WhatsApp accounts by replacing the device-linking QR code. Adobe has released a patch, version 26.5.2.3, which automatically updates for most users. Guardio Labs reported no signs of active exploitation and commended Adobe's swift response to the vulnerability, which affected an extension installed on approximately 329 million browsers.

Source: Bleeping Computer