Adobe extension flaw let any website read a visitor's WhatsApp Web chats

Guardio Labs disclosed HermeticReader, a flaw chain in the Adobe Acrobat extension for Chrome that let an attacker controlled web page read data from a visitor's WhatsApp Web session. Tracked as CVE-2026-48294 and rated 7.4, it is a cross origin disclosure issue affecting versions up to 26.5.2.2, installed on roughly 329 million browsers. Any site could disguise commands as internal extension messages, activate the extension's WhatsApp integration, and redirect its privileged page operations into the WhatsApp tab, extracting chats, contacts, and message previews. No malware, stolen credentials, or WhatsApp flaw was involved. Adobe patched within days.

Check

Confirm the Adobe Acrobat Chrome extension is updated to 26.5.2.3 or later across managed browsers, and review which other extensions hold broad permissions across sensitive web applications.

Affected

Anyone running the Adobe Acrobat Chrome extension at version 26.5.2.2 or earlier with an active WhatsApp Web session (CVE-2026-48294); visiting a malicious page was enough to expose chats and contacts.

Fix

Update the extension, govern browser extensions with allow lists and permission reviews, and remember that a widely trusted extension can turn any visited page into a route to session data.