A newly disclosed vulnerability chain in the Adobe Acrobat Chrome extension, installed on an estimated 329 million browsers, allowed attackers to silently siphon a victim’s entire WhatsApp Web session, including chat contents, contact names, and profile data, by simply luring them to a malicious webpage.
The flaw, tracked as CVE-2026-48294 and dubbed “HermeticReader” by researchers at Guardio Labs, required no malware, no phished credentials, and no stolen session cookies.
The exploit begins with an unauthenticated, zero-click write into the extension’s local storage from any web page, made possible because the extension’s manifest exposes web-accessible pages like frame.html that parse attacker-controlled JSON directly from the URL and relay it to the service worker, which never verifies the sender.
Adobe Acrobat Extension Flaw
That storage write flips a hidden developer feature flag that arms “Hermes,” Adobe’s dormant integration engine built to bridge Acrobat with WhatsApp Web. Once armed, the attacker still needs the numeric tab ID of the victim’s WhatsApp Web tab.
Because Chrome assigns tab IDs from a single incrementing counter, the attacker’s page first leaks its own tab ID through a loosely matched “google.com” host check, then opens a new WhatsApp Web tab and predicts its ID as one increment higher, eliminating any need to search or guess blindly.
With the target tab identified, the attacker sends privileged Hermes commands directly into the WhatsApp Web content script.
These commands expose powerful primitives, including DOM manipulation, arbitrary method invocation on page and window objects, and storage access, none of which are gated by an allowlist.
Rather than injecting executable code, which is blocked by WhatsApp’s content security policy, the Shaked Biner found a way to abuse legitimate HTML behavior.
They injected a hidden form into the WhatsApp DOM, then used DOM operations to physically relocate the live page body into an empty option element inside that form.
Submitting the form caused the option’s text content, effectively the entire rendered page, to be POSTed to the attacker’s server, because an option with no value attribute submits its text content and WhatsApp Web’s CSP does not restrict form-action destinations.
The result: WhatsApp Web itself performed the exfiltration, submitting its own rendered chat list, contact names, message previews, and open conversation text to an attacker-controlled endpoint.
Because the technique captures rendered text as it appears on screen, it could theoretically also capture one-time passcodes delivered via WhatsApp.
Guardio reported the full exploit chain to Adobe’s PSIRT after confirming it end-to-end at runtime. Adobe acknowledged the report, triaged it, and shipped a patched version, 26.5.2.3, over the same weekend, with CVE-2026-48294 formally issued days later.
The fix was delivered automatically to affected users, though Guardio recommends manually verifying the extension version given the scale of the install base.
The case underscores a broader industry blind spot: the vulnerabilities involved were not exotic memory-corruption bugs but mundane plumbing issues, unvalidated message senders, missing allowlists, and loose host matching.
Researchers also used an AI-assisted analysis harness to unpack the obfuscated extension code and map the exploit chain within hours of the vulnerable feature’s release, compressing a discovery timeline that historically took weeks into a single afternoon.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
