Adobe Acrobat Chrome Flaw Exposed WhatsApp Web Data
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Guardio Labs disclosed a vulnerability codenamed HermeticReader (CVE-2026-48294, CVSS 7.4) in the Adobe Acrobat Chrome extension, which has over 314 million users, enabling silent hijack of WhatsApp data via a single webpage visit
- The UXSS-class cross-origin data disclosure flaw affects all extension versions up to and including 26.5.2.2 and has now been patched
- Exploitation requires only that a victim open an attacker-crafted page—no malware installation, credential phishing, or session cookie theft is needed
- The attack chain activates the extension's dormant Hermes engine (feature flag "floodgate-add"), opens WhatsApp Web in a background tab, and abuses WhatsApp Web's missing CSP form-action directive to POST the rendered DOM to a controlled endpoint
- Captured data includes chat lists, contact names, message previews, profile names, and the visible text of any open conversation
- Shaked Biner of Guardio Labs traced the data exfiltration to two HTML-spec enablers: option elements with no value attribute submit their text content, and WhatsApp Web ships no form-action CSP directive
Why it matters: With 314 million Adobe Acrobat Chrome extension users potentially exposed, a single malicious page could empty a victim's WhatsApp Web chats without any malware or credential theft—and the underlying issue (missing CSP form-action directives plus HTML edge cases) is likely present in other web apps, meaning this class of 'plumbing' flaw may repeat elsewhere.
