Adobe has patched a series of vulnerabilities in its Acrobat Chrome extension that previously allowed any website to access conversations in WhatsApp Web without proper authentication, according to a report from cybersecurity firm Guardio shared with BleepingComputer.
The vulnerabilities, collectively identified as CVE-2026-48294 and named HermeticReader, affect versions 26.5.2.1 and earlier of the Adobe Acrobat Chrome extension.
Adobe fixed the issue in version 26.5.2.3, which is deployed automatically, but Guardio advises users to verify that they are running the updated version.
Exploiting the flaw only required a user with the extension installed to visit a malicious web page. Guardio reports no signs that the vulnerability has been actively exploited.
How the attack worked and what data was exposed
The Adobe Acrobat extension uses an integration engine called Hermes to manage interactions with WhatsApp Web. Hermes remains idle until a feature flag is enabled in the extension’s internal storage.
Once activated, you can open a PDF shared through WhatsApp and send commands to a tab running the messaging service, manipulating WhatsApp’s document object model.
According to Guardio, HermeticReader exploits three vulnerabilities that together allow unauthenticated, single-hit, click-free writing to the extension’s storage from any web page.
The extension includes an internal HTML resource that any page can embed as an iframe. This resource receives commands via a URL parameter, which is then passed to the extension’s service worker without checking whether the command originated from a legitimate Adobe content script.
By providing a predictable tab ID, an attacker could disguise commands as internal extension messages, trigger the WhatsApp integration, and redirect the extension’s privileged DOM operations to a WhatsApp web tab.
Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the active body of the page to an option element, and submitting the form to a server controlled by an attacker.
Since an option element without a specific value sends its text content and WhatsApp’s content security policy reportedly lacked a form-action restriction, the browser sent the page text to the attacker.
The exposed data included chat lists, contact names, messages, profile names, and conversation content. The attack did not require session cookies. Guardio points out that no unloaded or visible messages were filtered on the page.
Guardio also described a second scenario in which an attacker could use the same DOM control functions to replace the QR code that links the WhatsApp device and take over the account. This method requires the victim to scan a substituted QR code, which adds significant complexity and makes it less practical than the data theft technique.
Disclosure timeline and steps to take now
Guardio lead researcher Nati Tal told BleepingComputer that the company discovered the vulnerability just four hours after Adobe included it in an extension update. Adobe released a patch in two days, over a weekend. Guardio praised the quick response and noted that the extension is installed on approximately 329 million browsers.
Adobe told Guardio that it normally does not publish security bulletins for consumer products, but in this case it made an exception. Users of the Adobe Acrobat Chrome extension should verify that they have the latest patched version, as the fix requires updating to version 26.5.2.3.
To do this, open Chrome and go to chrome://extensions in the address bar. Turn on Developer mode using the switch in the top right corner to see the extension version numbers.
Search for Adobe Acrobat and check if the version is 26.5.2.3 or later. If it’s 26.5.2.1 or lower, open the Chrome menu, select Extensions, then Manage Extensions, and click Update to force an update. Restart Chrome after updating and check the version again.
Users who do not use the WhatsApp integration or the extension itself can remove it from the Manage Extensions page as an extra precaution.
The version 26.5.2.3 patch is automatically delivered to users. Guardio has not observed any exploitation of the vulnerability before the patch was released, but due to the extension’s large user base, unpatched instances still pose a risk until the update is released. Adobe has not issued a consumer safety bulletin about the issue beyond confirming it to Guardio.
