Adobe Acrobat Extension Vulnerability Exposes WhatsApp Data

A critical vulnerability in the Adobe Acrobat Chrome extension allows attackers to access private WhatsApp chats without authentication. This flaw, tracked as CVE-2026-48294, affects approximately 329 million users. The exploit requires victims to visit a malicious web page, which activates the extension's WhatsApp integration and enables data exfiltration. Guardio Labs discovered the vulnerability, which leverages the extension's internal HTML resource to execute commands through an iframe. Adobe responded promptly, issuing a patch over the weekend following the disclosure. The vulnerability can lead to unauthorized access to WhatsApp messages and contacts, although it does not expose messages that are not rendered. The attack method is classified as a single-visit, zero-click exploit, making it particularly dangerous. The vulnerabilities were reported on July 22, 2026.

Key Points: • CVE-2026-48294 allows access to WhatsApp data via the Adobe Acrobat Chrome extension. • The exploit requires only a single visit to a malicious web page, posing a significant risk. • Adobe quickly patched the vulnerability after its disclosure by Guardio Labs.