Skip to content
Braincap
← All articles

HermeticReader: an Adobe Chrome extension exposed WhatsApp chats

Illustration of a WhatsApp conversation exposed through a compromised browser extension

Guardio Labs researchers described a vulnerability (CVE-2026-48294), dubbed HermeticReader, in the Adobe Acrobat Chrome extension. Through it, a website the victim simply visited could — with no click at all — read private conversations on WhatsApp Web. Below are the facts as published.

In brief

  • Vulnerable product: the Adobe Acrobat Chrome extension, versions 26.5.2.1 and earlier.
  • Scale: roughly 329 million browsers had the extension installed.
  • Discovered by: Guardio Labs (principal researcher: Nati Tal).
  • Active exploitation: no evidence was found that the flaw had been exploited in the wild.
  • Fix: Adobe patched it in version 26.5.2.3.

The attack chain

Overview of the HermeticReader attack chain (based on Guardio Labs’ analysis)

The attack chained three issues, with no user interaction beyond visiting a website:

  1. Malicious website: the extension’s internal HTML page could be included as an iframe by any page, so a site could disguise its commands as internal extension messages.
  2. Zero-click storage write: through an unauthenticated, single-visit write into the extension’s own storage, the attacker flipped a hidden feature flag.
  3. Hermes engine active: once started, Hermes (the integration bridge between Acrobat and WhatsApp Web) accepted commands from the attacker’s website.
  4. Predictable Tab ID: using a predictable tab identifier, the attacker redirected privileged DOM operations into the WhatsApp Web tab.
  5. DOM manipulation (CSP bypass): the researchers injected a form and moved the page’s live body into an <option> element; because an <option> with no defined value submits its text content, the data was exfiltrated while bypassing WhatsApp’s CSP.
  6. Exfiltration: to an attacker-controlled server.

What data was exposed

  • the chat list;
  • contact names;
  • messages and conversation content;
  • the profile name.

Limitation: messages not rendered or not loaded into the page were not exposed.

Alternative vector

The researchers also showed that an attacker could replace WhatsApp’s device-linking QR code to take over the account — but that scenario required the victim’s cooperation (scanning the substituted code).

Adobe’s response

  • Adobe shipped the fix in version 26.5.2.3 within about two days (over a weekend), via automatic update.
  • Adobe acknowledged the issue on its security acknowledgements page, noting that it generally does not publish security bulletins for consumer products.
  • According to Guardio, the flaw was found just four hours after Adobe introduced it via an update, and the vendor’s response was immediate.

The takeaway

Browser extensions run with elevated privileges and can access the pages we visit — they are a real attack surface, not a footnote. That this chain required no click at all is exactly why keeping extensions updated, and limiting the installed ones to what you actually need, matters.

Sources