Adobe Acrobat Extension Vulnerability Exposed WhatsApp Web Messages to Malicious Sites

Key Findings

• Adobe Acrobat Chrome extension vulnerability (CVE-2026-48294, CVSS 7.4) affected 314+ million users and allowed silent theft of WhatsApp Web data
• Exploitation required only user interaction - visiting a malicious webpage - with no malware, credential theft, or session cookie compromise needed
• Vulnerability chain consisted of three separately unremarkable flaws in message passing, storage handling, and feature flags that composed into a critical attack
• Attack could capture chat lists, contact names, message previews, profile names, and visible conversation text
• Adobe patched the flaw within days of disclosure, shipping fix in version 26.5.2.3

Background

The vulnerability, codenamed HermeticReader by Guardio Labs, was a universal cross-site scripting vulnerability that allowed attackers to bypass the browser's same-origin policy. The Adobe Acrobat extension (ID: efaidnbmnnnibpcajpcglclefindmkaj) included a Hermes engine component designed to handle WhatsApp Web integration, but this integration contained multiple security gaps that worked together to create a complete data exfiltration chain.

Attack Mechanics

The exploitation sequence was straightforward but effective. An attacker would create a convincing webpage designed to appear like a legitimate search result or marketing email. When a victim with the Adobe Acrobat extension visited this page, the attacker could trigger a dormant engine within the extension by embedding hidden iframes from the extension's own resources. These frames could parse commands from the page's URL and relay them to the extension's service worker, which incorrectly trusted messages coming from the extension's own identity.

The Three Composable Flaws

The first flaw was that the extension's web-accessible resource pages could be embedded as hidden iframes by any website without restriction. These pages accepted JSON commands directly from URL query strings and relayed them to the service worker. The service worker never validated the sender of these messages, treating all internal sources as trusted.

The second flaw involved the extension's storage system. The service worker's message listener had no allowlist restricting what keys could be written to local storage. An attacker could write arbitrary values, including the critical feature flag "floodgate-add" set to "dc-cv-hermes" that activated the Hermes engine.

The third flaw was that the Hermes engine activated based solely on reading this feature flag from local storage, without additional verification. Once activated, the attacker gained control over a command dispatcher inside WhatsApp's tab, able to inject HTML, manipulate DOM nodes, and submit forms.

Data Exfiltration Technique

The most sophisticated aspect of the attack was how data actually left WhatsApp's origin. Rather than directly reading WhatsApp's data, the attacker weaponized WhatsApp's own functionality. The attack injected a POST form into WhatsApp's DOM and moved WhatsApp's entire body node into a form option element. Because option elements with no value attribute submit their text content, and because WhatsApp's content security policy lacked a form-action directive, WhatsApp itself performed the navigation by submitting its entire rendered DOM to the attacker's server.

This clever technique meant WhatsApp executed the exfiltration of its own data, sending the chat list, contact names, messages, and profile information to attacker-controlled infrastructure.

Detection and Response

Guardio Labs discovered the vulnerability within hours of Adobe's June 3 release of version 26.5.2.1, using an AI-powered analysis system that unpacked 344 obfuscated JavaScript files, mapped code differences, and analyzed a 138-case service worker message dispatcher. Adobe responded with remarkable speed, acknowledging the report and shipping a patch within the same weekend, with CVE-2026-48294 issued days later.

Structural Implications

Security researchers emphasized that this vulnerability exemplified a broader industry problem. While individual flaws in message passing, storage handling, and feature flags were not dramatic in isolation, their combination created a critical failure. The researchers noted that the security industry tends to focus on dramatic exploit categories while overlooking the "plumbing-level" vulnerabilities in foundational components, where composition of small oversights can lead to complete system compromise at scale.

Sources

• https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html
• https://securityaffairs.com/195805/hacking/adobe-acrobat-chrome-extension-bug-enabled-silent-whatsapp-data-theft.html
• https://mallory.ai/stories/019f8a2b-266c-7977-b811-bf6593dc1c5c
• https://www.bleepingcomputer.com/news/security/adobe-chrome-extension-flaw-let-sites-access-private-whatsapp-chats