Adobe Acrobat Chrome Extension Flaw (CVE-2026-48294) Enables Silent WhatsApp Data Theft

Cybersecurity researchers at Guardio Labs have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension, which has over 314 million users. The flaw, codenamed HermeticReader and officially tracked as CVE-2026-48294 (CVSS score: 7.4), is a universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability. It affects all versions of the extension (ID: efaidnbmnnnibpcajpcglclefindmkaj) prior to and including 26.5.2.2.

Successful exploitation bypasses the browser’s same-origin policy, allowing an attacker to access data linked to the victim’s session across origins. The attack requires user interaction: the victim must visit a maliciously crafted URL or interact with a compromised web page that triggers the extension’s vulnerable code path. The attacker can then obtain cross-origin read access to session-bound data, including authenticated content from third-party web applications loaded in the victim’s browser.

Guardio Labs researcher Shaked Biner explained that an attacker-controlled page can wake a dormant engine inside the extension, reach directly into WhatsApp Web, and steal the rendered chat list, contact names, message previews, profile name, and visible text of the open conversation. The attack does not require malware installation, credential phishing, or session cookie extraction.

The exploit sequence involves: an attacker-controlled page calling an iframe element from extension resources; the iframe sending commands to activate the Hermes engine (which handles WhatsApp integration) if a specific feature flag is enabled; the attacker page opening WhatsApp Web in a background tab; the iframe sending commands to the engine directed against the WhatsApp tab; and the engine manipulating WhatsApp Web’s DOM by injecting a POST form to steal data. Two HTML specification enablers allow this: an option element with no value attribute submits its text content, and WhatsApp Web’s content security policy lacks a form-action directive, allowing top-level form submission to any origin.

Guardio Labs concluded that composition is the threat, and plumbing-level flaws can lead to building-level collapse, especially with large install bases.