Adobe Acrobat extension flaw allowed silent WhatsApp data theft
Security vulnerability affecting millions of users has been patched.
1Critical Security Vulnerability
A flaw in Adobe Acrobat's Chrome extension allowed attackers to steal WhatsApp Web chats by redirecting users to a simple webpage. Discovered by Guardio Labs researcher Shaked Biner, the HermeticReader exploit chain could affect approximately 329 million browsers.
2How the Exploit Chain Worked
The vulnerability combined three separate flaws in the extension's internal messaging system. Attackers could manipulate pages trusted by the extension to gain full DOM control over a WhatsApp Web tab. This enabled silent data exfiltration without requiring any malware.
3Data Exfiltration Technique
Attackers injected a POST form into WhatsApp's DOM, sending entire chat contents to their servers. Interestingly, the data exfiltration was performed by WhatsApp itself. This technique was part of a complex exploit chain discovered by Guardio Labs using a custom AI system.
4AI-Powered Rapid Detection
Guardio Labs analyzed Adobe's version 26.5.2.1 released on June 3 within hours. A specialized AI system unpacked the extension's 344 obfuscated JavaScript files, comparing them with previously analyzed flows and mapping a 138-case message dispatcher.
5Adobe's Swift Response
Adobe acknowledged the vulnerability and released a patch the same weekend the report was received. Registered as CVE-2026-48294, the flaw posed a threat to millions of users. The company's quick action prevented a large-scale data breach.
6Security Lessons Learned
This incident demonstrates that high-install extensions must be more vigilant against security flaws. Twelve seemingly simple shortcuts in message passing, storage handling, and feature flags created an exploit chain reaching 329 million browsers. Security is now more critical than ever.