A flaw in Adobe Acrobat’s Chrome extension could let a website access WhatsApp Web conversations and other rendered data without authentication, after researchers linked the issue to CVE-2026-48294 and said it could be triggered by luring a user to a malicious page.
KEY FACTS
- Flaw CVE-2026-48294 affects Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier.
- Impact The issue could expose chat lists, contact names, messages, profile names and conversation content already rendered in WhatsApp Web.
- Trigger An attacker needed only to get a target to visit a page under attacker control.
- Fix Adobe released version 26.5.2.3 and delivered it automatically to users.
In a technical analysis by Guardio Labs, researchers said the attack chain, which they dubbed HermeticReader, let any web page disguise commands as internal extension messages and redirect privileged operations into a WhatsApp tab with a predictable Tab ID.
The report said the extension’s internal HTML resource could be embedded by any site as an iframe, and that a URL parameter was later passed to the service worker without checking whether it came from Adobe content script code or another page. Once the WhatsApp Web tab was controlled, the data leak used a form submission trick that could send rendered text to an attacker-controlled server.
Guardio said the flaw did not require session cookies, although it could only leak messages that had already been loaded and rendered in the browser. The researchers also described a separate scenario in which the same DOM-control capability could be used to swap in a fake WhatsApp device-linking QR code, though that would still require user action.
Guardio’s principal researcher said there was no sign of active exploitation and noted that Adobe patched the issue within two days after the report. Adobe acknowledged the flaw in its security acknowledgements, and users are advised to confirm that the extension is updated to version 26.5.2.3.
WHY IT MATTERS
The issue involved an extension installed on roughly 329 million browsers, according to the disclosure, and it showed how a browser add-on can be used to reach sensitive web app content when internal controls are weak. The patch is in place, but users still need to verify they are running the fixed version.