A newly disclosed flaw in the Adobe Acrobat Chrome extension allowed attackers to silently harvest WhatsApp Web chats, contacts, and profile data from any user who simply visited a malicious webpage no clicks, downloads, or credential theft required.
Security researchers at Guardio Labs uncovered the flaw, dubbed “HermeticReader,” and officially tracked as CVE-2026-48294 with a CVSS score of 7.4.
The bug is classified as a universal cross-site scripting (UXSS) issue that lets a malicious site bypass the browser’s same-origin policy and read data tied to a victim’s active session in another tab.
HermeticReader (Source: Guardio)
It affects every version of the Adobe Acrobat PDF Extension for Chrome up to and including 26.5.2.2, an extension installed on roughly 314–329 million browsers worldwide.
How the HermeticReader Attack Works
The exploit chain begins the moment a victim, who already has the extension installed, lands on an attacker-controlled page disguised as an ordinary site. From there, the attack unfolds in a few silent steps:
A hidden iframe loaded from the extension’s own web-accessible resources sends a forged message to the extension’s background service worker, which never verifies who the sender actually is.
This lets the attacker write arbitrary data into the extension’s local storage, flipping on a hidden feature flag that activates “Hermes,” Adobe’s dormant WhatsApp Web integration engine.
The malicious page then quietly opens WhatsApp Web in a background tab and predicts its numeric tab ID by exploiting Chrome’s sequential tab-numbering system.
Whatsapp Flow (Source: Guardio)
With that ID in hand, the attacker sends commands directly to Hermes’s content script running on the WhatsApp tab, manipulating the page’s DOM.
The final trick required no malicious script execution at all. Guardio’s researchers found that the compromised engine could inject a hidden form into WhatsApp Web’s page, then physically relocate the live chat body into that form using legitimate DOM operations.
Because the form’s hidden option field had no “value” attribute, submitting it caused the browser to send the entire rendered text content of the page chat lists, contact names, message previews, and the open conversation straight to the attacker’s server.
Since WhatsApp Web’s content security policy lacked a form-action restriction, the browser allowed this cross-origin submission without objection.
The exposure was limited to on-screen, rendered text rather than raw encrypted message payloads, but for most users that distinction offers little comfort visible chat content is the secret.
Guardio reported the issue to Adobe’s PSIRT, and the company moved unusually fast: the flaw was acknowledged, fixed, and shipped in version 26.5.2.3 within a single weekend, with the CVE formally assigned days later.
The fix was pushed automatically through the Chrome Web Store, though security teams recommend verifying that installed extension versions are current.
This case underscores a growing risk in the browser-extension ecosystem: individually minor flaws in message-passing, storage validation, and feature-flag logic can combine into a full account-compromise chain, especially in extensions with hundreds of millions of installs.
As more extensions integrate directly with messaging platforms, unaudited “plumbing” code, not just headline zero-days, is emerging as a critical attack surface.
The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment
The post Adobe Acrobat Extension Flaw Lets Attackers Steal WhatsApp Chats From 329 Million Users appeared first on Cyber Security News.
