Adobe Acrobat Chrome Extension Flaw Exposed WhatsApp Web Data in Silent Attack Security researchers at Guardio Labs uncovered a critical vulnerability in the Adobe Acrobat PDF Extension for Chrome, tracked as CVE-2026-48294 (CVSS 7.4), which allowed attackers to silently harvest WhatsApp Web chats, contacts, and profile data from users who merely visited a malicious webpage without requiring clicks, downloads, or credential theft. Dubbed "HermeticReader", the flaw was a universal cross-site scripting (UXSS) issue that bypassed Chrome’s same-origin policy, enabling attackers to read data from an active WhatsApp Web session in another tab. The vulnerability affected all versions of the extension up to 26.5.2.2, which was installed on 314–329 million browsers worldwide. ### How the Attack Worked 1. Initial Exploitation: A victim with the vulnerable extension lands on an attacker-controlled webpage. 2. Forged Messaging: A hidden iframe exploited the extension’s web-accessible resources to send unverified commands to its background service worker. 3. Feature Flag Activation: Attackers manipulated local storage to enable "Hermes", Adobe’s dormant WhatsApp Web integration engine. 4. Tab Hijacking: The malicious page predicted WhatsApp Web’s tab ID using Chrome’s sequential numbering system. 5. DOM Manipulation: The attacker injected a hidden form into WhatsApp Web, relocating live chat content into it. 6. Data Exfiltration: Submitting the form sent rendered chat text, contact names, and message previews to the attacker’s server all without triggering security warnings. The attack exploited weak form-action restrictions in WhatsApp Web’s content security policy, allowing cross-origin data submission. ### Response & Impact Adobe acknowledged and patched the flaw within a weekend, releasing version 26.5.2.3 via the Chrome Web Store. The fix was automatically deployed, though users were advised to verify their extension version. The incident highlights a growing risk in browser extensions with massive install bases, where seemingly minor flaws in message-passing, storage validation, and feature-flag logic can chain into full account compromise. As extensions increasingly integrate with messaging platforms, unvetted "plumbing" code is becoming a critical attack surface.