Adobe Acrobat Chrome Extension Flaw Exposed WhatsApp Web Data of 314M Users

Cybersecurity researchers at Guardio Labs have disclosed a now-patched vulnerability in the Adobe Acrobat Chrome extension—used by more than 314 million users—that could allow a malicious website to silently harvest a victim's WhatsApp Web data. Codenamed HermeticReader and tracked as CVE-2026-48294 with a CVSS score of 7.4, the flaw is classified as a universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability. It affects all versions of the extension (ID: efaidnbmnnnibpcajpcglclefindmkaj) up to and including 26.5.2.2, enabling attackers to bypass the browser's same-origin policy and access session-bound data across origins—provided the victim visits an attacker-crafted page.

According to Guardio Labs researcher Shaked Biner, the attack chain begins when a victim lands on a malicious page disguised as a routine search result or marketing email. The page calls an iframe loaded from the extension's resources and sends commands that activate the dormant Hermes engine—the component that handles WhatsApp integration—via a feature flag known as "floodgate-add." The attacker page then opens WhatsApp Web in a background browser tab, obtains its numeric tab ID, and instructs the Hermes engine to inject a POST form directly into WhatsApp's DOM. The exploit leverages an obscure HTML specification behavior: an <option> element with no value attribute submits its text content, and the text content of a node is the concatenation of everything rendered beneath it—effectively exfiltrating chat lists, contact names, message text, and profile information out of WhatsApp's origin. The entire sequence requires no malware installation, no credential phishing, and no session cookie theft. Users concerned about exposure to similar cross-origin attacks can run a browser fingerprint test to assess how identifiable their browser session is, and review their overall exposure with a privacy checkup.

Notably, the flaw required only user interaction—visiting a compromised or maliciously crafted URL—to trigger the vulnerable code path within the extension. Because the Hermes engine was already present in all installs of the extension, any user with the Adobe Acrobat Chrome extension installed who clicked the wrong link was potentially a target. Researchers urge users to update to the latest patched version of the extension immediately and to verify that no sensitive sessions remain exposed. For organizations concerned about whether corporate accounts may have been compromised, checking credentials against known exposures via an email breach checker is a recommended first step.