Cybersecurity researchers at **Guardio Labs** have uncovered a serious vulnerability chain, collectively dubbed **HermeticReader** and tracked as **CVE-2026-48294**, within the **Adobe Acrobat** extension for **Google Chrome**. This flaw could have allowed malicious actors to access sensitive **WhatsApp Web** conversations and data without any form of authentication. ### How HermeticReader Operated The attack exploited the **Adobe Acrobat** extension's ability to activate its **WhatsApp** integration and redirect privileged Document Object Model (DOM) operations into a **WhatsApp** tab. This was achieved by disguising attacker commands as internal extension messages. **Guardio Labs** explained that the vulnerability stemmed from the extension allowing any website to include an internal HTML resource as an iframe. This internal page then processed commands received via a URL parameter, sending them to the service worker – the extension's backend with elevated permissions – without properly verifying their origin. This unauthenticated, single-visit, zero-click write into the extension's internal storage from any web page was the core of the **HermeticReader** exploit. ### Stealing WhatsApp Communications The exploit chain allowed attackers to manipulate the **WhatsApp Web** DOM. **Guardio** demonstrated data theft by injecting a form into **WhatsApp Web**, moving the page’s live body into an `<option>` element, and then submitting this form to an attacker-controlled server. Because an option without a defined value submits its text content, and **WhatsApp**'s Content Security Policy (CSP) reportedly lacked a `form-action` restriction, the browser sent the rendered page text to the attacker. This granted access to a wealth of sensitive information, including: * Chat lists * Contact names * Messages * Profile names * Conversation content Crucially, the **HermeticReader** attack required no session cookies. While it could not leak messages that were not loaded or rendered, the exposure of active conversation data was significant. **Guardio** also highlighted a scenario where attackers could hijack **WhatsApp** accounts by replacing the device-linking QR code. However, this would require the victim to scan the substituted code, adding a layer of user interaction not present in the primary data theft method. .jpg) ### Rapid Response and Patch Availability The **HermeticReader** flaws affected versions 26.5.2.1 and below of the **Adobe Acrobat** Chrome extension. **Adobe** swiftly addressed the issue, releasing a patch in version 26.5.2.3, which has been automatically delivered to users. **Guardio Labs** principal researcher, **Nati Tal**, commended **Adobe**'s rapid response, noting that the vulnerability was caught just four hours after its introduction via an update, and a patch was rolled out within two days, over a weekend. While **Adobe** generally does not publish security bulletins for consumer products, they have acknowledged the flaw on their security acknowledgements page. Users are strongly advised to verify that their **Adobe Acrobat** extension for **Chrome** is updated to version 26.5.2.3 to ensure protection against this vulnerability. **Guardio** has reported no indications of active exploitation for **CVE-2026-48294**.