A vulnerability chain in the Adobe Acrobat Chrome extension exposed over 314 million users to potential WhatsApp data theft. Guardio Labs researchers disclosed the flaw, codenamed HermeticReader and tracked as CVE-2026-48294, which carries a CVSS severity score of 7.4.
The vulnerability allowed malicious websites to silently access WhatsApp Web data from infected browsers without user knowledge or consent. Attackers exploiting this chain could intercept private messages, contact lists, and other sensitive conversation metadata by tricking users into visiting compromised sites while the Acrobat extension remained active.
Adobe has patched the flaw. The extension's massive user base, spanning 314 million installations across Chrome, made this vulnerability a high-value target. Attackers needed no interaction beyond user presence on a malicious domain. The attack surface spanned any website, making drive-by exploitation entirely feasible for threat actors running ad networks or compromised sites.
The vulnerability chain likely exploited inadequate sandbox restrictions within the extension's communication protocols or improper handling of cross-origin requests. Chrome extensions often maintain elevated privileges compared to standard web pages, creating attack vectors when permissions aren't properly validated.
Organizations and individuals using the Adobe Acrobat Chrome extension should update immediately to the patched version. Users should verify their extension versions through the Chrome Web Store and enable automatic updates if not already configured. While the vulnerability has been patched, users should remain cautious of WhatsApp Web sessions on shared or public computers, particularly in corporate environments where multiple users access the same machines.
This incident underscores the security risks posed by browser extensions with broad permissions. Extensions accessing document processing capabilities often request permissions spanning multiple domains, creating potential for data exfiltration if the extension itself becomes compromised or contains flaws in permission handling.