Adobe Acrobat Chrome extension bug enabled silent WhatsApp data theft – Security Affairs

Adobe patched CVE-2026-48294, a flaw in Adobe Acrobat Chrome extension that could let attackers steal WhatsApp Web chats by luring users to a webpage. Guardio Labs researcher Shaked Biner disclosed HermeticReader, a vulnerability chain in the Adobe Acrobat Chrome extension that allowed any attacker-controlled webpage to silently steal a visitor’s WhatsApp chats, contacts, profile name, and message previews in plain text. The extension sits on roughly 329 million browsers. No malware, no phished password, no compromised session cookie — just visiting the wrong page was enough. “Read the prerequisites list of this exploit chain and the discomfort sets in: no malware is installed, no password is phished, no session cookie is touched. There is no zero-day in WhatsApp.” reads the report published by Guardio Labs. “The attacker needs no Adobe account and no foothold on the machine. Only for the victim to visit a simple attacker-controlled static page.” The attack chains three separate flaws in the extension’s internal messaging system. None of them are dramatic on their own. Together they hand an attacker full DOM control over an open WhatsApp Web tab. The first flaw is that the extension’s web-accessible resource pages, frame.html, searchWidget.html, and others, can be embedded as
Read More