A Trusted Adobe Extension Left Your Private WhatsApp Chats Wide Open to Hackers

Imagine simply visiting a website and having your private WhatsApp conversations, contact names, chat lists, and other private information hijacked by a malicious threat actor. A recent vulnerability found in Adobe's Chrome extension could allow attackers to do exactly that.

The vulnerability, tracked as CVE-2026-48294^[1], puts around 329 million Adobe Acrobat Chrome extension users at risk. The scary part is that simply visiting a malicious website is enough to trigger the attack. Then, within just a few minutes, your sensitive WhatsApp data could end up in the attacker's hands.

Here's everything you need to know about the vulnerability, how it works, and the steps you can take right now to protect yourself.

Thanks for subscribing!

Please check your email for your first message.

Take back control of your privacy.

Join thousands who get our privacy-first newsletter every week. No spam. No nonsense.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How attackers exploit the vulnerability

The vulnerability was first discovered by a team of security researchers at Guardio Labs, who named it HermeticReader.

For the attack to work, the victim first needs to have the Adobe Acrobat Chrome extension installed and WhatsApp Web open in a browser tab.

Here's how things unfold after this:

• Inside the browser lies a component called Hermes, which stays dormant until activated. Hermes's job is to let the extension open PDF files shared in WhatsApp chats.
• Next, the attacker only needs the victim to visit a web page, which can be done by delivering the link through social engineering tactics, phishing emails, messages, or other means. There's no download required, no login needed, and no credential stealing involved.
• That web page contains a hidden iframe that loads the Adobe extension's internal HTML page. This internal page should have been restricted for use by the extension only. However, this particular internal page had a flaw that allowed anyone to access it and send instructions to it.
• The attacker's page then sends instructions through a simple URL parameter, and the page forwards them to the extension's service worker without verifying whether the incoming request came from Adobe's own code or an external source.
• The instruction flips an internal flag, which activates Hermes, thereby enabling its ability to read and edit the Document Object Model (DOM) of any WhatsApp Web tab.
• Every browser tab has an internal ID number. However, according to Guardio Labs, the tab ID for WhatsApp Web is predictable, which allows the attacker to feed that ID into Hermes so that it knows where to execute the next command.
• The attacker then injects a hidden form by modifying the DOM of the WhatsApp Web page through Hermes instructions.
• This form has no defined value for the "option" element. So, the entire visible content of the page gets copied into the "option" element. This includes the entire body of the currently open WhatsApp Web page, including contact names, the visible chat list, and the messages in the open chat window. This is why the attacker deliberately leaves the "option" attribute undefined.
• Finally, the hidden form is submitted to the attacker's server.

Usually, websites use a security rule called Content Security Policy (CSP) to restrict where a page's forms are allowed to send data. However, according to Guardio's research, WhatsApp Web's CSP was missing this restriction, which allowed the attacker to exfiltrate WhatsApp data.

What happens if your data is stolen

The concerning part is that the attack happens in the background, without the victim's knowledge, and could be triggered by a simple visit to a malicious website, with no further action required.

It's worth noting that only data currently visible on the WhatsApp Web screen can be exposed this way. Chats or messages that haven't loaded or synced in the browser aren't accessible to the attacker.

If this information falls into the wrong hands, it could be used to commit identity theft, financial fraud, or launch highly targeted phishing campaigns designed to steal even more of your personal information.

How Adobe responded

Researchers discovered the vulnerability only four hours after Adobe introduced it via an update. Guardio Labs promptly reported the vulnerability to Adobe.

The company responded professionally by acknowledging the issue, fixing it, and releasing a patched version within two days. Thanks to this swift action, the researchers didn’t find any evidence of the vulnerability being exploited in the wild.

"Adobe's response to our full disclosure was phenomenal. They go straight to the point, protect their users – shipping the fix, and did it before the weekend was out. That shouldn't be remarkable. But it sure is!," Guardio Labs said.

What can you do to protect yourself

Since Adobe has already patched the vulnerability and released an update, you'll need to make sure you're using the latest version of the Adobe Acrobat Chrome extension.

CVE-2026-48294 affects version 26.5.2.1 and earlier. The issue has been resolved in version 26.5.2.3 and later, while 26.7.2.0 is the latest version, updated on June 21, 2026.

To update your Adobe extension:

1. Open your browser and type chrome://extensions.
2. Make sure Developer mode is turned on in the top-right corner.
3. Click the Update button in the top-left corner.
4. Chrome will automatically scan for and apply any available extension updates.

Once you've made sure you're not using the older vulnerable extension version, here are some steps you can take to stay safe from similar attacks in the future.

• Do not click on malicious links: CVE-2026-48294 can only work if the user visits a malicious URL. So, avoid clicking on any suspicious links from unknown senders. Such malicious links are usually delivered through phishing texts, scam messages, malvertising campaigns, or other social engineering tactics.
• Use antivirus with web protection: The best antivirus programs today come with real-time web/URL scanning, which can flag and block known malicious and phishing websites before they load.
• Use an identity theft protection service: If you regularly share sensitive information such as your credit card number, Social Security number, or other personally identifiable information on WhatsApp (which you should avoid), consider getting an identity theft protection service. It monitors the dark web, credit bureaus, and other databases for signs that your personal information is being misused, allowing you to take action.

Bottom line

Adobe's latest Chrome extension vulnerability allows malicious actors to harvest your WhatsApp Web data. Worse still, you only need to visit a malicious website to trigger the attack. There's no need for the attacker to steal passwords, logins, or browser cookies.

On the bright side, however, Adobe reacted quickly, patched the issue, and released an update (version 26.5.2.3). To stay protected, make sure you're using the latest version of the Adobe Acrobat Chrome extension.

Additionally, follow good cyber hygiene by avoiding suspicious phishing links and refraining from sharing or storing overly sensitive information on WhatsApp.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On DeleteMe's website

2026 Editors’ Choice

Best Data Removal for Couples

Privacy Protection

DeleteMe

PROMOTION: Use the Code PARTNER20 for 20% Off

• Data removal service that covers 85-262 sites and re-scans every quarter to catch anything that reappears
• Sends quarterly privacy reports showing what info was found, which brokers had your data, and how long each removal took
• Includes email masking so you can share a stand-in address instead of your real one

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news