Adobe Chrome Extension Flaw Lets Sites Access Private WhatsApp Chats

A $60B Vote of Confidence

The Adobe Acrobat Chrome extension is a widely used tool that allows users to interact with WhatsApp Web. However, a recent flaw in the extension has been discovered that allows hackers to access private WhatsApp chats without authentication. The attack exploits a chain of vulnerabilities tracked as CVE-2026-48294 and dubbed HermeticReader by researchers at Guardio.

The HermeticReader attack requires no session cookies and can be executed by luring the target to a web page under the threat actor's control. The attack works by disguising attacker commands as internal extension messages, activating the WhatsApp integration, and redirecting the privileged DOM operations into a WhatsApp tab with a predictable Tab ID. By supplying that ID to the extension, the attacker can direct commands to the WhatsApp Web tab to the Hermes engine, which acts as an intermediary between Acrobat and WhatsApp.

The Hermes engine is the integration engine that the Adobe Acrobat Chrome extension uses to handle its interactions with WhatsApp Web. It stays dormant until a specific feature flag is activated in the extension's internal storage. Once running, Hermes can receive requests from the integration, open a PDF file shared through WhatsApp, and send back responses. It can be used to send commands directly to a tab running the messaging service through a script that can manipulate the WhatsApp Document Object Model (DOM).

In a report shared with BleepingComputer, Guardio says that HermeticReader exploits three vulnerabilities that allow 'an unauthenticated, single-visit, zero-click write into the extension's own storage from any web page.' The extension has an internal HTML resource that is part of the extension, but it allows ANY page to include it as an iframe. The way this internal HTML page receives commands is via a URL parameter that is later processed and sent to the service worker, which is the backend of the extension with all the leveraged permissions, without checking whether it came from a real Adobe content script or any other page.

Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the page's live body into an <option> element, and submitting the form to an attacker-controlled server. Because an option without a defined value submits its text content, and WhatsApp's content security policy (CSP) reportedly lacked a form-action restriction, the browser sent the rendered page text to the attacker, allowing access to messaging data: Chat list Contact names Messages Profile name Conversation content

Despite the significant exposure, the HermeticReader attack requires no session cookies. It should be noted that messages that were not loaded or rendered are not leaked in the attack. Guardio researchers mention another scenario where hackers can hijack WhatsApp accounts. By leveraging the same DOM-control functionality, an attacker could replace the device-linking QR code for WhatsApp to take control of the user's account. However, this scenario would require the victim to scan the substituted QR code, which adds considerable friction.

The HermeticReader flaws are tracked as CVE-2026-48294 and affect versions 26.5.2.1 and below of Adobe Acrobat Chrome extensions. The issue has been fixed in 26.5.2.3 and delivered automatically to users. Nevertheless, users are recommended to check if they have the latest release installed. Guardio Labs' principal researcher, Nati Tal, told BleepingComputer that they have seen no indication of active exploitation for CVE-2026-48294. The researcher noted that they caught the flaw only four hours after Adobe introduced it via an update to the extension. The vendor reacted quickly to the vulnerability report and rolled out a patch within two days, over a weekend. Guardio commended Adobe's rapid response, saying that the vendor's immediate action matched the urgency of such a flaw in an extension 'installed on roughly 329 million browsers'. Adobe told Nati Tal that it generally doesn't publish security bulletins for consumer products, but the firm has acknowledged the flaw here. Users should verify that their Adobe Acrobat extension for Chrome is updated to version 26.5.2.3.