A Browser Extension Installed 300 Million Times Had a Flaw That Let Attackers Steal Your WhatsApp Messages
A security hole in Adobe's widely used browser extension meant that simply visiting the wrong website could hand criminals your private messages and contacts.
Key points
- A vulnerability, meaning a security flaw in software, was found in an Adobe browser extension with more than 300 million installs worldwide.
- The flaw allowed an attacker to steal WhatsApp messages and contact lists from a victim's device.
- No complicated trick was required: the victim only needed to visit a malicious website the attacker controlled.
- Adobe has since patched the extension, meaning a fix has been released.
- Users who haven't updated their browser extensions recently should do so now.
Three hundred million is a lot of people. If that extension were a country, it'd be the fourth most populous on Earth. For a window of time, every one of those installs carried a flaw that could empty out your WhatsApp inbox.
The vulnerability sat inside an Adobe browser extension, a small add-on program that users install into Chrome or similar browsers to extend what those browsers can do. Adobe's extensions are trusted by designers and everyday professionals around the world. That trust is exactly what made this flaw dangerous.
The attack itself was grimly simple. A criminal sets up a website rigged to exploit the flaw. You visit that site, perhaps through a link in an email or a social media post. Nothing visible happens. Behind the scenes, the extension's security boundary breaks down, and your WhatsApp messages and contacts quietly travel to the attacker's server. No password needed, no file download required, just a page load.
How did the flaw actually work?
The extension failed to properly check where certain requests were coming from, a classic mistake web developers have been warned about since the early 2000s. Security researchers call this a cross-origin flaw, but the concept is old enough to have a dusty shelf in every web-security textbook. A malicious page could pretend to be a trusted source, and the extension believed it. The result: data walked out the door.
It's a pattern we've seen before on this beat. Our 14 July report on ClaudeBleed found another browser extension quietly leaking user data despite repeated patch attempts, and extensions haven't gotten safer since.
SecurityWeek first reported the flaw. At the time of writing, a CVE identifier, the official tracking number assigned to a specific software vulnerability, hadn't been publicly assigned, so there's no NVD page to link to yet.
Adobe has patched the extension. The fix is out.
If you use any Adobe browser extension, open your browser's extension settings today and confirm you're running the latest version. Most browsers update extensions automatically, but that process isn't always instant. Manually checking takes thirty seconds.
Also worth doing: look over recent WhatsApp conversations for messages you didn't send or contacts you don't recognise. If something looks wrong, change your WhatsApp security code under Settings and let your contacts know.
Should you worry about other extensions too?
Yes. Extensions from any vendor can carry flaws like this. Your attack surface, meaning the total number of ways an attacker can reach you, grows with every extension you add. Keep your list short, remove anything you no longer use, and update what stays.
