GoKawiilThe Adobe Acrobat extension for Chrome could be used to access conversations and data rendered in WhatsApp Web without any form of authentication.
The attack exploits a chain of vulnerabilities, collectively tracked as CVE-2026-48294 and dubbed HermeticReader by researchers at cybersecurity firm Guardio.
Exploiting them requires only that the target running the Adobe Acrobat extension be lured to a web page under the threat actor's control.
Stealing WhatsApp communications
The problem arises from the Adobe extension allowing any website to disguise attacker commands as internal extension messages, activate its WhatsApp integration, and redirect its privileged DOM operations into a WhatsApp tab with a predictable Tab ID.
By supplying that ID to the extension, the attacker could direct commands to the WhatsApp Web tab to the Hermes engine, which acts as an intermediary between Acrobat and WhatsApp.
Hermes is the integration engine that the Adobe Acrobat Chrome extension uses to handle its interactions with WhatsApp Web. It stays dormant until a specific feature flag is activated in the extension's internal storage.
Once running, Hermes can receive requests from the integration, open a PDF file shared through WhatsApp, and send back responses. It can be used to send commands directly to a tab running the messaging service through a script that can manipulate the WhatsApp Document Object Model (DOM).
In a report shared with BleepingComputer, Guardio says that HermeticReader exploits three vulnerabilities that allow "an unauthenticated,single-visit, zero-click write into the extension's own storage from any web page."
"The extension has an internal HTML resource that is part of the extension, but it allows ANY page to include it as an iframe," Guardio Labs explained.
... continue reading