Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Summary: Researchers at Guardio Labs disclosed a now-patched vulnerability chain, codenamed HermeticReader and tracked as CVE-2026-48294 (CVSS 7.4), in the Adobe Acrobat Chrome extension used by over 314 million people, affecting all versions up to and including 26.5.2.2. The UXSS-class flaw bypasses the same-origin policy so that a victim who visits a crafted page can have their WhatsApp Web chat list, contact names, message previews, profile name, and open conversation text read by the attacker, without malware, credential phishing, or session cookie theft.
Why it matters: The exploit rests on two ordinary HTML behaviors - an option element submitting its rendered text and WhatsApp Web's content security policy lacking a form-action directive - so the extension's install base of 314 million is exposed by plumbing rather than a dramatic exploit class.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-48294
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026