Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
A vulnerability in the Adobe Acrobat Chrome extension has been disclosed, which could allow malicious sites to read WhatsApp web data. The flaw, codenamed HermeticReader, affects all versions of the extension prior to and including 26.5.2.2.
Intelligence analysis by Llama
A vulnerability in the Adobe Acrobat Chrome extension could allow malicious sites to read WhatsApp web data. The flaw, codenamed HermeticReader, affects all versions of the extension prior to and including 26.5.2.2. An attacker can exploit this flaw to capture the rendered chat list, contact names, message previews, the profile name, and the visible text of the open conversation.
Imagine you're using a browser extension to access WhatsApp web. A malicious website can trick you into visiting a fake page that looks like a normal search result. This page can then access your WhatsApp data, including your chat list, contact names, and messages. This is because the browser extension has a vulnerability that allows it to access data from other websites. The attacker can use this vulnerability to steal your WhatsApp data without you even realizing it.
Analysis
A Silent Hijack of WhatsApp Data
The recently disclosed vulnerability in the Adobe Acrobat Chrome extension, codenamed HermeticReader, has the potential to facilitate a silent hijack of a user's WhatsApp data. This flaw, officially tracked as CVE-2026-48294 (CVSS score: 7.4), affects all versions of the extension prior to and including 26.5.2.2.
The vulnerability is a case of universal cross-site scripting (UXSS)-class cross-origin data disclosure. It requires user interaction, as a victim must be convinced into visiting a maliciously crafted URL or interact with a compromised web page that triggers the extension's vulnerable code path. An attacker can weaponize this flaw to obtain cross-origin read access to session-bound data, including authenticated content from third-party web applications loaded in the victim's browser.
The sequence of actions involved in exploiting this flaw is as follows: an attacker-controlled page calls an iframe element loaded from the extension resources, which sends commands to alter settings to activate the Hermes engine. The Hermes engine handles WhatsApp integration in the extension only if a specific feature flag is enabled. The attacker page then opens WhatsApp Web in a browser tab in the background, and the iframe sends commands directly to the engine directed against the WhatsApp tab after obtaining the tab's numeric ID. The engine manipulates WhatsApp Web's DOM by injecting a POST form into WhatsApp's DOM to steal WhatsApp data.
The industry's focus on dramatic exploit classes often leads to overlooking plumbing-level flaws, which can compose into building-level collapse. The bigger the install base, the longer the building stands before anyone checks the joints. In this case, the Adobe Acrobat extension's vulnerability has the potential to capture the rendered chat list, contact names, message previews, the profile name, and the visible text of the open conversation.
Composition is the Threat
The setup for this vulnerability is almost insultingly ordinary. An attacker-controlled page, dressed to look like the kind of page you land on via search results, marketing emails, etc., is opened by the visitor, who already has the Adobe Acrobat extension installed. The page wakes up a dormant engine inside the extension, reaches directly into WhatsApp Web, and seconds later, the rendered WhatsApp Web view - the chat list, contact names, messages, the profile name, the text of whatever conversation is open - the whole WhatsApp in the attacker's hands.
Why Does Submitting a Form Carry Chat Text Out of WhatsApp's Origin?
The reason for this is two enablers deep from the HTML specifications. An option element with no value attribute submits its text content, and the text content of a node is the concatenation of everything rendered beneath it. Move the live body in, and the option's submitted value becomes the entire rendered page text! The second enabler is that WhatsApp Web's content security policy ships no form-action directive, and per the spec that absence means a top-level form submission may navigate to any origin. So WhatsApp itself performs the navigation, POSTing its own rendered DOM to our controlled endpoint and then dutifully rendering whatever we send back.
The Industry's Attention
The industry pours its attention into the dramatic exploit classes and leaves the plumbing to the assumption that nobody will ever look hard at it. Composition is the threat. Plumbing-level flaws compose into building-level collapse, and the bigger the install base, the longer the building stands before anyone checks the joints.
Key points
- A vulnerability in the Adobe Acrobat Chrome extension has been disclosed, which could allow malicious sites to read WhatsApp web data.
- The flaw, codenamed HermeticReader, affects all versions of the extension prior to and including 26.5.2.2.
- An attacker can exploit this flaw to capture the rendered chat list, contact names, message previews, the profile name, and the visible text of the open conversation.
- Adobe has already patched the vulnerability, and users can update their extension to the latest version to stay safe.
- Users can be more cautious when visiting websites and avoid clicking on suspicious links to stay safe.
Adobe has already patched the vulnerability, and users can update their extension to the latest version to stay safe. Additionally, users can be more cautious when visiting websites and avoid clicking on suspicious links.
The vulnerability highlights the importance of ensuring the security of browser extensions and the potential risks of cross-origin data disclosure. If users are not careful, they may fall victim to this type of attack, which can result in the theft of sensitive information.
