guard.io Adobe Acrobat Extension Vulnerability Enables WhatsApp Data Theft
Article Content
- •CVE-2026-48294 allows unauthorized access to WhatsApp Web data via Adobe Acrobat extension.
- •The vulnerability affects around 329 million users and requires only a visit to a malicious site.
- •Adobe has released a patch, and Guardio Labs reported no signs of active exploitation.
A critical vulnerability in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294 and named HermeticReader, allows attackers to access WhatsApp Web data without authentication. The flaw affects approximately 329 million users and requires only a single visit to a malicious webpage. Exploitation involves manipulating the extension's integration engine, Hermes, which can execute commands on WhatsApp Web through predictable Tab IDs. Guardio Labs discovered the vulnerability and demonstrated data theft by injecting forms into WhatsApp Web. Adobe has released a patch (version 26.5.2.3) to address the issue, and there are no indications of active exploitation. The vulnerability impacts all versions of the extension up to 26.5.2.2.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (9)
Following this threat?
Track Adobe and CVE-2026-48294 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…