Back Securityaffairs.Co

Adobe Acrobat Chrome extension bug enabled silent WhatsApp data theft

Securityaffairs.Co •Pierluigi Paganini • July 22, 2026

Adobe patched CVE-2026-48294, a flaw in Adobe Acrobat Chrome extension that could let attackers steal WhatsApp Web chats by luring users to a webpage. Guardio Labs researcher Shaked Biner disclosed HermeticReader, a vulnerability chain in the Adobe Acrobat Chrome extension that allowed any attacker-controlled webpage to silently steal a visitor’s WhatsApp chats, contacts, profile name, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Adobe Acrobat Extension Vulnerability Enables WhatsApp Data Theft A critical vulnerability in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294 and named HermeticReader, allows attackers to access WhatsApp Web data without authentication. The flaw affects approximately 329 million users and requires only a single visit to a malicious webpage. Exploitation involves manipulating the extension's integration engine, Hermes, which can execute commands on WhatsApp Web through predictable Tab IDs. Guardio Labs discovered the vulnerability and demonstrated data theft by injecting forms into WhatsApp Web. Adobe has released a patch (version 26.5.2.3) to address the issue, and there are no indications of active exploitation. The vulnerability impacts all versions of the extension up to 26.5.2.2. 7 sources 71

Extracted Entities

Adobe Acrobat Chrome extension bug enabled silent WhatsApp data theft

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)