Cybersecurity researchers at **Guardio Labs** have detailed a now-patched vulnerability chain in the **Adobe Acrobat** Chrome extension that, if exploited, could have led to a silent takeover of a user's **WhatsApp** data. The flaw, codenamed **HermeticReader**, is officially tracked as **CVE-2026-48294** (CVSS score: 7.4). It's categorized as a universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability, affecting all versions of the extension (ID: `efaidnbmnnnibpcajpcglclefindmkaj`) prior to and including 26.5.2.2. ### How the Exploit Works Successful exploitation of **HermeticReader** could bypass the browser's same-origin policy, granting access to session-bound data across different origins. The only prerequisite is user interaction: a victim must be tricked into visiting a maliciously crafted URL or interacting with a compromised web page that triggers the extension's vulnerable code path. This means an attacker could obtain cross-origin read access to authenticated content from third-party web applications loaded in the victim's browser. "The setup is almost insultingly ordinary: an attacker-controlled page, dressed to look like the kind of page you land on via search results, marketing emails, etc.," explained **Guardio Labs** researcher **Shaked Biner** in a report shared with The Hacker News. "The visitor, who already has the **Adobe Acrobat** extension installed, opens that page."  "The page wakes up a dormant engine inside the extension, reaches directly into **WhatsApp Web**. Seconds later, the rendered **WhatsApp Web** view - the chat list, contact names, messages, the profile name, the text of whatever conversation is open - the whole **WhatsApp** in the attacker's hands." Crucially, this vulnerability did not require the attacker to install malware, phish credentials, or extract session cookies. Simply visiting the crafted web page was enough. ### The Attack Chain The sequence of actions involved: 1. An attacker-controlled page calls an iframe element loaded from the extension's resources. 2. The iframe sends commands to alter settings, activating the **Hermes** engine (which handles **WhatsApp** integration in the extension) if a specific feature flag ("floodgate-add") is enabled. 3. The attacker page opens **WhatsApp Web** in a background browser tab. 4. The iframe sends commands directly to the **Hermes** engine, targeting the **WhatsApp** tab after obtaining its numeric ID. 5. The engine manipulates **WhatsApp Web's** DOM by injecting a POST form to steal **WhatsApp** data. **Biner** further elaborated on the mechanics: "Why does submitting a form carry chat text out of **WhatsApp's** origin? Two enablers deep from the HTML specifications: An option element with no value attribute submits its text content - and the text content of a node is the concatenation of everything rendered beneath it. Move the live body in, and the option's submitted value becomes the entire rendered page text!" "The second enabler is that **WhatsApp Web's** content security policy that ships no form-action directive, and per the spec that absence means a top-level form submission may navigate to any origin. So **WhatsApp** itself performs the navigation, POSTing its own rendered DOM to our controlled endpoint and then dutifully rendering whatever we send back." This allowed a threat actor to capture sensitive information such as the rendered chat list, contact names, message previews, the profile name, and the visible text of any open conversation. ### The Broader Implications **Guardio Labs** emphasized the overlooked danger of such "plumbing-level" flaws: "The industry pours its attention into the dramatic exploit classes and leaves the plumbing to the assumption that nobody will ever look hard at it. Composition is the threat. Plumbing-level flaws compose into building-level collapse, and the bigger the install base, the longer the building stands before anyone checks the joints." Users are advised to ensure their **Adobe Acrobat** Chrome extension is updated to the latest version to mitigate this risk.