Adobe Acrobat: extension flaw could read WhatsApp Web

Guardio Labs detailed CVE-2026-48294 (codenamed HermeticReader) in the Adobe Acrobat PDF extension for Chrome. The flaw let a malicious website bypass the same-origin policy and read data tied to the victim’s session on other services — in the demonstration, private WhatsApp Web chats. The extension is installed on hundreds of millions of browsers, so the potential exposure is broad.

We stick to what the researchers and the vendor have confirmed.

What the bug was

CVE-2026-48294 is a UXSS / cross-origin data disclosure vulnerability scored CVSS 7.4. In practice it meant that code on an attacker-controlled page could, thanks to a flaw in the extension, reach into data from a different origin — bypassing a fundamental browser security boundary.

In their demo the researchers used it against WhatsApp Web: it was possible to read the chat list, contact names, and message content. It is worth stressing that the same-origin policy exists precisely so that site A cannot read site B’s data — and a flawed extension became the bridge that skipped that boundary.

What to know about scope and the patch

Vulnerable were all versions of the Adobe Acrobat extension for Chrome up to and including 26.5.2.2. The extension has — by various estimates — on the order of 314–329 million installs, making it a very wide attack surface.

Adobe fixed the bug in version 26.5.2.3, distributed automatically through the Chrome Web Store within a single weekend. Exploitation required user interaction — the victim had to visit a crafted URL or a compromised page that triggered the vulnerable code.

The lesson: extensions are a real attack surface

This case shows well why browser extensions deserve the same attention as any other software. They hold broad permissions, run in the context of the pages you visit, and are often installed en masse without IT oversight. It is a classic example of shadow IT — tools that enter the organisation outside the process yet still access sensitive data.

The good news here is that the Chrome Web Store auto-update mechanism worked quickly. The bad news is that users often do not even know how many extensions they have installed, or what permissions those hold.

What to do

1. Check the extension version. Make sure the Adobe Acrobat extension for Chrome is 26.5.2.3 or newer. In chrome://extensions, enable developer mode to see the version number.
2. Verify extension auto-updates. Auto-update usually handles this, but in environments with policies that block updates it is worth confirming the fix actually landed.
3. Review installed extensions. Remove unused ones and those with excessive permissions. Any extension with access “to all sites” is a potential cross-origin bridge.
4. Manage extensions centrally in the enterprise. Consider an allowlist of extensions via browser policy instead of leaving installation to users.
5. Treat the browser like an operating system. It is now the main environment for working with data — its hygiene (updates, extension minimalism) is part of workstation security.

The bottom line

HermeticReader required the victim to install nothing malicious — a popular, legitimate extension with a bug plus a visit to the wrong page was enough. Updating to 26.5.2.3 closes this specific hole, but the lasting takeaway is control over what runs in your organisation’s browsers. If you want to get a grip on extensions and shadow IT, let’s start with a review.

Sources: The Hacker News, BleepingComputer, Security Affairs.