Adobe Patches Acrobat Chrome Extension Flaw That Exposed WhatsApp Web Chats to Any Website

Adobe has patched a series of vulnerabilities in its Acrobat Chrome extension that previously allowed any website to access conversations in WhatsApp Web without proper authentication, according to a report from cybersecurity firm Guardio shared with BleepingComputer. The vulnerabilities, collectively identified as CVE-2026-48294 and called HermeticReader, affect Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier. Adobe addressed the issue in version 26.5.2.3, which is rolled out automatically, but Guardio advises users to verify that they are running the updated release. Exploitation of the flaw required only that a user with the extension installed visit a malicious webpage. Guardio reports no signs that the vulnerability has been actively exploited. How the Attack Worked and What Data Was Exposed The Adobe Acrobat extension uses an integration engine called Hermes to manage interactions with WhatsApp Web. Hermes remains inactive until a feature flag is enabled in the extension’s internal storage. Once activated, it can open a PDF shared via WhatsApp and send commands to a tab running the messaging service, manipulating WhatsApp’s Document Object Model. According to Guardio, HermeticReader exploits three vulnerabilities that together enable an unauthenticated, single-visit, zero-click write into the extension’s own storage from any web page. The extension includes an
Read More