Adobe's Acrobat Chrome extension leaked WhatsApp Web chats to any website you visited
Researchers at Guardio Labs found a chain of flaws, tracked as CVE-2026-48294, that let any web page silently read messages, contacts and chat lists from WhatsApp Web. Adobe patched the extension within two days.
Key points
- Guardio Labs disclosed a flaw chain, tracked as CVE-2026-48294 and named HermeticReader, in the Adobe Acrobat extension for Google Chrome.
- The bug affected Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier, installed on roughly 329 million browsers.
- A single visit to a booby-trapped web page was enough to expose a victim's WhatsApp Web chat list, contact names and open conversations.
- Adobe shipped a fix in version 26.5.2.3, pushed automatically to users over a weekend, two days after the report.
- Guardio says it has seen no signs of the flaw being used in real attacks.
An extension that most people installed to open PDF files turned out to be a doorway into their private WhatsApp messages.
Researchers at the security firm Guardio Labs found that the Adobe Acrobat extension for Chrome could be tricked into handing over the contents of a user's WhatsApp Web tab to any website they happened to visit. No authentication prompt, no warning. One page load was enough.
The flaw chain, first reported by BleepingComputer, is tracked as CVE-2026-48294 and nicknamed HermeticReader. It affects Adobe Acrobat Chrome extension versions 26.5.2.1 and below. Adobe fixed it in version 26.5.2.3.
How could a PDF extension read your WhatsApp messages?
The extension contained a hidden helper called Hermes, whose job was to let Adobe Acrobat open PDF files shared inside WhatsApp Web. To do that, Hermes needed permission to reach into a WhatsApp tab and read what was on the screen. The problem was that the extension didn't check who was asking it to use that power.
Guardio found that any web page could load one of the extension's own internal pages inside an invisible frame and pass instructions through a web address. The extension's background service then acted on those instructions as if Adobe itself had sent them.
From there, the attacking page could direct Hermes at the victim's open WhatsApp Web tab and copy whatever was rendered there. Guardio demonstrated the theft by injecting a hidden form into WhatsApp Web, sweeping the visible page content into it, and posting it to a server the researchers controlled. WhatsApp's content security policy (a browser-enforced ruleset that controls where a page can send data) lacked a restriction on where form submissions could go, so the browser complied.
Leaked data included the chat list, contact names, the user's profile name and the text of conversations open on screen. Messages that hadn't been loaded weren't exposed. No session cookie was needed: the attack piggybacked on the session the user already had open.
This is the second browser-extension vulnerability we've covered in as many months. A July flaw in Anthropic's Claude extension showed the same pattern: a trusted add-on accepting instructions it should have rejected outright.
Should ordinary WhatsApp users be worried?
Probably not, but check your extension version today.
Adobe pushed version 26.5.2.3 automatically to Chrome users, so most people will already have it. To confirm, open Chrome, navigate to the extensions page and verify the version number shown for Adobe Acrobat.
Guardio's principal researcher, Nati Tal, told BleepingComputer the team spotted the bug only four hours after Adobe introduced it in an update, and that Adobe patched it within two days, over a weekend. There's no sign anyone else found or exploited it.
One further scenario is worth flagging. The same DOM control (the ability to read and rewrite what's displayed on a web page) could, in theory, swap out the QR code WhatsApp shows when you link a new device, letting an attacker link their own phone to your account. That only works if the victim actually scans the replaced code.
The broader point is one this beat keeps returning to: a browser extension is never a small thing. It often holds permission to read every page you open, your bank and your messages included. HermeticReader is a precise illustration of what happens when one of those extensions treats instructions from any random page as authoritative. Adobe told Guardio it doesn't typically publish security bulletins for consumer products, but has acknowledged the flaw.
