A critical vulnerability, tracked as CVE-2026-48294, in the Adobe Acrobat Chrome extension allowed attackers to silently exfiltrate sensitive WhatsApp Web data, including chat content, contact lists, and profile information. The flaw, which Adobe has since patched, could be exploited simply by a victim visiting a malicious webpage.
The vulnerability chain, dubbed "HermeticReader" by Guardio Labs researcher Shaked Biner, did not require malware installation, credential phishing, or compromised session cookies. It leveraged three distinct weaknesses within the extension's internal messaging system to grant an attacker full control over the Document Object Model (DOM) of an open WhatsApp Web tab. The Adobe Acrobat Chrome extension is reportedly installed on approximately 329 million browsers.
The first flaw involved the extension's web-accessible resource pages, such as `frame.html` and `searchWidget.html`, which could be embedded as hidden iframes by any website. These pages parsed a JSON object directly from their URL query string and relayed it as a message to the extension's service worker. Because this script executed within the `chrome-extension://efaidn…/` context, the service worker perceived the message as originating from a trusted internal source, effectively allowing an attacker to masquerade as the extension itself.
Attackers could manipulate various fields within this message, with `panel_op` needing to be set to "load-frictionless" and `main_op` being overwritten to "relay_to_content" during transmission. The service worker's message listener lacked sender verification, and its storage writer had no allowlist for permissible writes. This allowed any webpage to write arbitrary keys into the extension's local storage without user interaction.
The third vulnerability related to Adobe's Hermes engine, a component responsible for WhatsApp Web integration. The Hermes engine activates based on a feature flag read from local storage. By writing the specific key `floodgate-add = "dc-cv-hermes"`, an attacker could immediately activate Hermes. Once active, Hermes provided a command dispatcher within the WhatsApp tab, enabling the injection of HTML, invocation of methods on any DOM node, form submission, and relaying messages back to the service worker.
One of the available commands, `APPEND_HTML_TO_TARGET`, could replace WhatsApp's login QR code with an attacker-controlled version. If a user scanned this modified QR code to link a new device, they would inadvertently pair the attacker's session instead of their own.
The data exfiltration method was particularly ingenious. Attackers injected a POST form into WhatsApp's DOM and then used the `ELEMENT_OPERATION` command to move WhatsApp's entire body node into the form's option element. Since an option element without a `value` attribute submits its text content, and WhatsApp's content security policy lacked a `form-action` directive, submitting this form sent the entire rendered page—including chat lists, contact names, and message text—to the attacker's server. Essentially, WhatsApp itself performed the data exfiltration.
Guardio Labs discovered this vulnerability within hours of Adobe releasing version 26.5.2.1 on June 3. Their research utilized a custom agentic AI system that unpacked and analyzed the extension's 344 obfuscated JavaScript files, mapped code differences against previously analyzed flows, and processed a 138-case service-worker message dispatcher. This AI-driven approach significantly reduced the discovery timeline from what would typically take days or weeks to mere hours.
Adobe responded swiftly, acknowledging, patching, and shipping a fix within the same weekend the report was received. CVE-2026-48294 was subsequently issued. The incident highlights how a combination of seemingly minor shortcuts in message passing, storage handling, feature flags, and host matching can coalesce into a significant vulnerability chain affecting a large user base.
