The Adobe Acrobat extension for Chrome could be leveraged by attackers to reach private conversations and rendered data on WhatsApp Web without requiring any authentication.

The attack chain, tracked collectively as CVE-2026-48294 and named HermeticReader by Guardio researchers, takes advantage of multiple weaknesses in the extension.

Carrying out the exploit needs only that the victim, who has the Adobe Acrobat extension installed, visit a webpage controlled by the attacker.

Accessing WhatsApp messages

The core issue stems from the extension permitting any website to mask malicious commands as legitimate internal messages, enable its WhatsApp feature, and route privileged DOM actions into a WhatsApp tab identified by a predictable Tab ID.

Providing that ID to the extension lets the attacker send commands through the Hermes engine, which serves as the bridge between Acrobat and WhatsApp Web.

Hermes remains inactive until a feature flag is set inside the extension storage. Once active, it can accept integration requests, open PDFs shared via WhatsApp, and return responses while also allowing direct commands to manipulate the WhatsApp DOM.

Guardio reports that HermeticReader combines three flaws to achieve an unauthenticated single-visit zero-click write into the extension storage from any webpage.

The extension includes an internal HTML resource that any page can load inside an iframe. Commands reach this page through a URL parameter that gets processed and forwarded to the service worker without verifying the source.

Researchers showed data theft by inserting a form into WhatsApp Web, relocating the page body into an option element, and submitting the form to a server they controlled. Because the option element submits its text when no value is set and WhatsApp CSP lacked a form-action limit, the full rendered text reached the attacker.

This granted access to the chat list, contact names, messages, profile name, and conversation content. The attack needs no session cookies, though only rendered messages are exposed.

Guardio also described a scenario where attackers could hijack accounts by swapping the device-linking QR code on WhatsApp Web. This path still requires the victim to scan the altered code.

Available patches

The flaws affect Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier. Adobe released version 26.5.2.3, which updates automatically, though users should confirm they have the newest release.

Guardio principal researcher Nati Tal stated there are no signs of active exploitation in the wild. The issue was discovered only four hours after an extension update introduced it, and Adobe issued a fix within two days.

Adobe generally avoids security bulletins for consumer products yet acknowledged the problem. Users are advised to ensure their extension is updated to version 26.5.2.3.