Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data

Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data. The shortcoming has been codenamed HermeticReader by Guardio Labs. It's officially tracked as CVE-2026-48294 (CVSS score: 7.4), with the vulnerability

The article describes CVE-2026-48294 (HermeticReader), a UXSS-class cross-origin data disclosure vulnerability in the Adobe Acrobat Chrome extension that allowed any attacker-controlled website to abuse the extension’s privileged integration with WhatsApp Web and silently exfiltrate chats, contacts, and account data in clear text simply by luring a user to a malicious page.[1][4][6] Adobe patched the issue in version 26.5.2.3 of the extension, which has hundreds of millions of installs, after disclosure by Guardio Labs.[1][2][4] From a RealGround perspective, this is a software supply chain and extension-privilege data leakage risk: similar flaws in browser extensions or AI-related plugins that integrate with messaging or productivity tools could let hostile web content or compromised components read sensitive conversation and business data. Organizations should treat third-party extensions and integrations (including AI agents/plugins) as part of their AI supply chain, maintain an SBOM and extension inventory, enforce strict approval and update policies, and continuously review privileged integrations for cross-origin and data access vulnerabilities.