Guardio

Adobe Acrobat Chrome Extension Flaw Enabled Silent Theft of WhatsApp Web Conversations

A vulnerability in the Adobe Acrobat extension for Chrome allowed attackers to silently extract WhatsApp Web conversations, contacts, and account data without any user interaction beyond visiting a malicious page. The issue affected approximately 329 million browser installations and required no password theft or malware infection. Researchers at Guardio named the attack HermeticReader and traced it to an internal messaging flaw that let a hidden iframe execute unverified commands inside the extension. This activated the dormant Hermes integration mechanism, which acted as a bridge to WhatsApp Web and exfiltrated data in plaintext while the user viewed an ordinary webpage. Adobe received the report, fixed the bug in June, and assigned it CVE-2026-48294, classifying it as a UXSS vulnerability that enables cross-site data disclosure. The extension's failure to validate message sources allowed the malicious site to write data to local storage and trigger the integration without warnings.