The PDF Extension Could Read WhatsApp. The Browser’s Same-Origin Wall Did Not Apply.
A malicious website could turn Adobe’s Acrobat extension for Chrome into a cross-origin reader for WhatsApp Web. The page did not need a WhatsApp vulnerability, a stolen password or malware on the device. It borrowed the extension’s privileged position inside the browser.
Guardio Labs disclosed the chain as HermeticReader on 22 July 2026. Adobe assigned it CVE-2026-48294 and fixed the vulnerability in Acrobat PDF extension version 26.5.2.3. Versions 26.5.2.2 and earlier are affected.
The potential reach was exceptional. The official extension had more than 300 million installations. A vulnerable user also needed an authenticated WhatsApp Web session and had to visit an attacker-controlled or compromised page. Public research demonstrates the capability; it does not present evidence that attackers used the chain in the wild.
The website never received WhatsApp’s permission
Browsers normally isolate websites by origin. A page on one domain cannot read the private content rendered by another domain simply because both tabs are open. Extensions can receive broader privileges so they can integrate with pages, files and services. HermeticReader abused that trusted intermediary.
Guardio found that an attacker page could load a web-accessible frame from the Acrobat extension and send messages that were not adequately bound to a trusted sender. The chain then wrote to the extension’s local storage and enabled Hermes, a dormant Adobe integration component used for interaction with WhatsApp Web.
From the extension’s privileged context, the attack could reach the WhatsApp tab, manipulate its rendered document and move page content into a hidden form for submission to an attacker-controlled server. The same-origin boundary still applied to the malicious page itself. The extension provided the bridge around it.
The demonstrated data exposure was large but specific
The proof of concept captured the rendered chat list, contact names, message previews, the user’s profile name and the visible text of the open conversation. That is sensitive session data in plain text after WhatsApp Web has decrypted and rendered it for the user.
It was not a break of WhatsApp’s end-to-end encryption, and it did not automatically recover every historical message that had never been loaded into the page. It did not require stealing a WhatsApp password or session cookie. The privacy failure occurred after authentication and decryption, where a trusted browser extension could see and manipulate content that an ordinary website could not.
CVE-2026-48294 carries a CVSS score of 7.4 and is described as a UXSS-class cross-origin data-disclosure vulnerability. The numerical score understates the strategic feature of the finding: a high-reach extension converted one page visit into access across a different authenticated service.
Adobe closed the chain quickly
Guardio reported the vulnerability in early June with a working proof of concept. Adobe triaged and patched it over the same weekend, then distributed the updated extension through the Chrome Web Store. That response reduced the exposure window, especially for browsers allowed to install extension updates automatically.
Automatic delivery is not the same as verified deployment. Managed browsers can pin versions, delay updates or retain disabled and rarely used extensions across profiles. Organisations need an inventory, not an assumption.
What users and administrators should do
- Verify that the Adobe Acrobat Chrome extension is version 26.5.2.3 or later.
- Inventory the extension by its identifier,
efaidnbmnnnibpcajpcglclefindmkaj, across managed Chrome and compatible Chromium profiles. - Remove the extension where its PDF integration is not required, rather than retaining broad permissions for occasional use.
- Keep automatic extension updates enabled and alert on policies or local conditions that prevent them.
- If exposure is suspected, preserve browser history and extension-version evidence, review WhatsApp linked devices and session activity, and assess which conversations were rendered during the visit.
- Review enterprise extension allowlists for products with cross-site permissions and privileged page-messaging interfaces.
HermeticReader is a browser-security story more than a WhatsApp story. The page that initiated the chain was not trusted to read the user’s messages. The extension was. Once the extension failed to verify who was asking, its legitimate cross-site authority became the attack primitive.
Sources: Guardio Labs HermeticReader research (22 July 2026; no publication time provided), SecurityWeek (22 July 2026 at 10:22 ET), Malwarebytes (23 July 2026; no publication time provided), and NVD record (published 17 June 2026 and updated 29 June 2026; source provides dates but no publication times).
