A humble PDF viewer installed in browsers more than three hundred million times turned out to be a doorway into other people’s WhatsApp conversations. Remarkably, the attack demanded neither malware nor stolen passwords.
The flaw lived inside the Adobe Acrobat extension for Chrome. Guardio Labs uncovered it and christened it HermeticReader. The issue carries the identifier CVE-2026-48294 and a CVSS 3.1 score of 7.4.
What the Flaw Actually Broke
Every version of the extension up to and including 26.5.2.2 was affected. The bug permitted a bypass of the browser’s same-origin policy, the mechanism that normally forbids one site from reading another site’s data.
Consequently, an attacker could reach content bound to the victim’s session inside a completely different open tab. That is a serious breach of the boundary browsers exist to enforce.
How the Attack Unfolded
A Single Visit Was Enough
The victim merely had to land on a specially prepared page while running the extension. Attackers disguised such pages as ordinary search results or links arriving in a mailing list.
Waking the WhatsApp Integration
The page then activated a dormant mechanism hidden inside the extension, the component responsible for WhatsApp integration. A special flag switched it on.
Afterwards, the page quietly opened WhatsApp Web in a background tab. It also captured that tab’s numeric identifier, so it could aim its commands precisely.
Turning WhatsApp Against Itself
At this point, the peculiarities of the WhatsApp page itself came into play. The extension injected a hidden form into the page.
One interface element then transmitted everything contained within it upon submission. In practice, that meant the entire visible text of the page.
A final oversight completed the chain. WhatsApp Web’s content security policy imposed no restriction on where forms could be submitted. As a result, the WhatsApp page itself dispatched the harvested data to the attacker’s server, then displayed whatever came back in reply.
What an Attacker Could See
The exposure was substantial. An outsider could observe the chat list, contact names, brief message previews, the victim’s profile name, and the text of whichever conversation sat open on screen.
Notably, the whole chain required only a single interaction with the page. No further conditions applied.
The Fix and What Users Should Do
By the time the report appeared, newer versions of the extension had already closed the hole. Users should therefore confirm they are running a build later than 26.5.2.2.
Beyond patching, caution around link delivery matters. Guardio Labs described exactly that route as the delivery method, so treat links arriving in email and search results with appropriate suspicion.
The Broader Lesson
Browser extensions carry sweeping privileges and enormous install bases. That combination makes even mundane plumbing flaws dangerous.
Therefore, organisations should audit which extensions their users run. Trimming unnecessary ones, and limiting those with broad permissions, remains the most reliable defence.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
