The Adobe Acrobat extension for Chrome could be used to access conversations and data rendered in WhatsApp Web without any form of authentication.
The attack exploits a chain of vulnerabilities, collectively tracked as CVE-2026-48294 and dubbed HermeticReader by researchers at cybersecurity firm Guardio.
Exploiting them requires only that the target running the Adobe Acrobat extension be lured to a web page under the threat actor’s control.
Stealing WhatsApp communications
The problem arises from the Adobe extension allowing any website to disguise attacker commands as internal extension messages, activate its WhatsApp integration, and redirect its privileged DOM operations into a WhatsApp tab with a predictable Tab ID.
By supplying that ID to the extension, the attacker could direct commands to the WhatsApp Web tab to the Hermes engine, which acts as an intermediary between Acrobat and WhatsApp.
Hermes is the integration engine that the Adobe Acrobat Chrome extension uses to handle its interactions with WhatsApp Web. It stays dormant until a specific feature flag is activated in the extension’s internal storage.
Once running, Hermes can receive requests from the integration, open a PDF file shared through WhatsApp, and send back responses. It can be used to send commands directly to a tab running the messaging service through a script that can manipulate the WhatsApp Document Object Model (DOM).
In a report shared with BleepingComputer, Guardio says that HermeticReader exploits three vulnerabilities that allow “an unauthenticated,single-visit, zero-click write into the extension’s own storage from any web page.”
“The extension has an internal HTML resource that is part of the extension, but it allows ANY page to include it as an iframe,” Guardio Labs explained.
“The way this internal HTML page receives commands is via a URL parameter that is later processed and sent to the service worker, which is the backend of the extension with all the leveraged permissions, without checking whether it came from a real Adobe content script or any other page,” the researchers told BleepingComputer.
Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the page’s live body into an
.jpg)
Source: Guardio Labs
Because an option without a defined value submits its text content, and WhatsApp’s content security policy (CSP) reportedly lacked a form-action restriction, the browser sent the rendered page text to the attacker, allowing access to messaging data:
- Chat list
- Contact names
- Messages
- Profile name
- Conversation content
Despite the significant exposure, the HermeticReader attack requires no session cookies. It should be noted that messages that were not loaded or rendered are not leaked in the attack.
Guardio researchers mention another scenario where hackers can hijack WhatsApp accounts. By leveraging the same DOM-control functionality, an attacker could replace the device-linking QR code for WhatsApp to take control of the user’s account.
However, this scenario would require the victim to scan the substituted QR code, which adds considerable friction.
Fixes available
The HermeticReader flaws are tracked as CVE-2026-48294 and affect versions 26.5.2.1 and below of Adobe Acrobat Chrome extensions.
The issue has been fixed in 26.5.2.3 and delivered automatically to users. Nevertheless, users are recommended to check if they have the latest release installed.
Guardio Labs’ principal researcher, Nati Tal, told BleepingComputer that they have seen no indication of active exploitation for CVE-2026-48294.
The researcher noted that they caught the flaw only four hours after Adobe introduced it via an update to the extension. The vendor reacted quickly to the vulnerability report and rolled out a patch within two days, over a weekend.
Guardio commended Adobe’s rapid response, saying that the vendor’s immediate action matched the urgency of such a flaw in an extension “installed on roughly 329 million browsers”.
Adobe told Nati Tal that it generally doesn’t publish security bulletins for consumer products, but the firm has acknowledged the flaw here.
Users should verify that their Adobe Acrobat extension for Chrome is updated to version 26.5.2.3.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
