Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data

A vulnerability in the Adobe Acrobat Chrome extension has been disclosed, allowing attackers to steal WhatsApp Web data. The flaw, codenamed HermeticReader (CVE-2026-48294) and assigned a CVSS score of 7.4, enables an attacker to bypass the browser's same-origin policy and access data linked to a user’s WhatsApp Web session. The exploitation requires only a user to visit a maliciously crafted webpage – no malware installation or credential theft is necessary.

Successful exploitation hinges on a user visiting a crafted webpage. The attacker-controlled page leverages an iframe to activate a dormant engine within the extension, specifically designed to handle WhatsApp integration when a certain feature flag is enabled. This triggers the engine to manipulate WhatsApp Web in a background browser tab, injecting a POST form to steal chat data, contact names, message previews, and profile information.

The vulnerability is described as a ‘composition’ issue, highlighting how seemingly minor plumbing-level flaws can combine to create significant security risks, especially given the extension’s large user base. The vulnerability is due to the absence of a form-action directive in WhatsApp Web’s content security policy, allowing the injected POST form to navigate to any origin and steal data.

Guardio Labs researcher Shaked Biner emphasized that the issue is not a dramatic exploit class, but rather a consequence of overlooking the potential for vulnerabilities within the extension’s underlying components. The vulnerability affects all versions of the Adobe Acrobat Chrome extension prior to and including 26.5.2.2.