TLDR Tech / InfoSec
Flaw in Adobe Extension With 300M Installs Enabled WhatsApp Data Theft
Guardio researchers discovered a UXSS-class cross-origin flaw, CVE-2026-48294, in the Adobe Acrobat Chrome extension (installed in roughly 329 million browsers) that let an attacker steal a victim's WhatsApp messages, contacts, and account details simply by luring them to a malicious webpage, with no WhatsApp bug, malware, or credential compromise required. Dubbed HermeticReader, the attack used a hidden frame to exploit missing validation in the extension's internal messaging system, silently writing to local storage to activate Hermes, a dormant Adobe integration engine that then bridged to WhatsApp Web and scraped private data in plain text. Adobe patched the issue in June shortly after disclosure. Defenders should confirm Acrobat extension auto-updates have applied the fix and treat any Chrome extension's internal messaging channels as an underexamined attack surface.
Read the full story