Adobe Acrobat Extension Flaw Allowed Malicious Sites to Access WhatsApp Web Data
Security vulnerability enabled malicious sites to access WhatsApp Web data.
1Security Vulnerability Discovered
A security vulnerability in the Adobe Acrobat Chrome extension, affecting over 314 million users, was discovered. This flaw allowed malicious sites to access WhatsApp Web data. The vulnerability was named HermeticReader by Guardio Labs and is tracked as CVE-2026-48294.
2Impact of the Vulnerability
This security vulnerability bypassed the browser's same-origin policy, allowing access to the victim's session data. The flaw required user interaction, necessitating the victim to visit a malicious URL or interact with a compromised web page.
3Attack Mechanism
Attackers could exploit this flaw by injecting a POST form into WhatsApp Web's DOM, thereby stealing WhatsApp data. This was possible due to WhatsApp Web's lack of a content security policy directive.
4Data Theft Process
Attackers opened WhatsApp Web in a background tab and sent commands via an iframe to manipulate WhatsApp Web's DOM. This process allowed them to capture the victim's WhatsApp chat list, contact names, messages, and profile information.
5Industry Implications
Guardio Labs noted that such vulnerabilities are often overlooked and can lead to severe consequences in systems with large installation bases. These flaws can combine underlying weaknesses, causing large-scale collapses.
6Measures and Outcomes
The security vulnerability in the Adobe Acrobat extension was patched with an update. However, this incident highlighted how critical vulnerabilities in widely installed extensions can be. Regular updates are crucial for users.