An alarming vulnerability was discovered in a widely-used Chrome extension developed by Adobe, potentially allowing unauthorized access to users’ WhatsApp conversations and contacts. The flaw, identified by the cybersecurity firm Guardio, highlighted significant risks of data theft without breaking into the targeted device or deploying malware.
How the Vulnerability Was Discovered
Guardio’s security researchers were responsible for identifying the weakness and promptly reported it to Adobe. This vulnerability could have been exploited by simply luring users into opening a seemingly innocuous webpage. Importantly, the exploit did not depend on any weaknesses within WhatsApp itself.
The attack strategy, named HermeticReader, targeted the Adobe Acrobat Chrome extension, which is prevalent among users, boasting approximately 329 million installations. The issue was swiftly addressed by Adobe, who released a patch in June upon receiving the report, classifying it as CVE-2026-48294, a UXSS-class cross-origin data disclosure issue.
The Mechanism of the Exploit
The attack leveraged insufficient security validations within the extension’s internal messaging system. By visiting a malicious site, users inadvertently triggered a hidden process that manipulated the extension into executing unauthorized commands. This exploit enabled attackers to write onto the extension’s local storage, activating Hermes, an Adobe-built integration engine.
Once Hermes was operational, it provided a conduit to WhatsApp Web, allowing the attacker to extract sensitive information like chats and contact lists stealthily. This seamless breach operated without alerting the user, posing a significant threat to privacy.
Response and Implications
Adobe’s response to the vulnerability was both rapid and effective, neutralizing the threat soon after its discovery. The patch not only safeguarded users but also underscored the necessity for continuous vigilance in software security.
This incident serves as a crucial reminder of the importance of regular updates and security checks for all software applications. As cyber threats evolve, so must the measures to counter them, ensuring data integrity and privacy are maintained.
For a visual demonstration of the HermeticReader attack, Guardio has made available an informative video showcasing the exploit in action.
Related security updates include Meta’s recent $78,000 bounty payout for a customer support vulnerability and OpenSSL’s silent fix of the ‘HollowByte’ DoS vulnerability.
