A critical vulnerability in the Adobe Acrobat Chrome extension has been identified, risking the exposure of WhatsApp Web chats, contact lists, and profile information. This security flaw, which was discovered by researchers at Guardio Labs, could be exploited by attackers through a simple visit to a compromised webpage, requiring no user interaction such as clicking or downloading.
Details of the HermeticReader Flaw
The vulnerability, named ‘HermeticReader’ and officially cataloged as CVE-2026-48294, has been given a CVSS score of 7.4. This bug is categorized as a universal cross-site scripting (UXSS) issue, allowing malicious websites to bypass browser security protocols and access data from other active browser sessions.
Guardio Labs has traced the flaw to versions of the Adobe Acrobat PDF Extension for Chrome up to 26.5.2.2. This extension is installed on approximately 314 to 329 million Chrome browsers globally, highlighting the widespread potential for data breaches.
Mechanics of the Exploit
The attack sequence begins when a user with the vulnerable extension installed visits an attacker-controlled site. The malicious site uses a hidden iframe to send unauthorized messages to the extension’s background service without validation. This action enables the attacker to alter local storage settings, activating a dormant feature within the extension known as ‘Hermes’.
This feature opens WhatsApp Web in a background tab using a predictable tab ID, allowing the attacker to issue commands to the Hermes content script. The attacker can then inject a form into the WhatsApp Web page, relocating visible chat content into this form. Due to insufficient security restrictions, the form submission transfers this data to the attacker’s server.
Response and Broader Implications
Upon discovering the issue, Guardio promptly alerted Adobe’s Product Security Incident Response Team (PSIRT). Adobe responded swiftly, issuing a patched version, 26.5.2.3, through the Chrome Web Store within a weekend. Users are advised to ensure their extensions are updated to this version to mitigate the risk.
This incident highlights the growing dangers within the browser extension ecosystem. Even seemingly trivial flaws can form a chain leading to significant data breaches, particularly in extensions with large user bases. As direct integrations with messaging platforms increase, unreviewed code components become prime targets for exploitation.
In response to this growing threat, security experts recommend regular updates and audits of browser extensions to safeguard against potential vulnerabilities.
