A chain of vulnerabilities in the Adobe Acrobat Chrome extension could have allowed attackers to steal content from a victim's WhatsApp Web session simply by luring them to a malicious website.
Adobe fixed the flaws within days of the report and assigned the issue CVE-2026-48294.
Guardio researcher Shaked Biner discovered the vulnerability shortly after Adobe released version 26.5.2.1 of the extension on June 3, 2026. The researcher said he identified the new attack surface within hours using an internally developed AI-assisted analysis platform that compares extension updates, deobfuscates code, and highlights newly introduced attack paths, then validates them manually.
Adobe Acrobat is one of the most widely used browser extensions, providing PDF viewing and editing features alongside integrations with web services such as Google Drive and, more recently, WhatsApp Web. The newly introduced WhatsApp integration ultimately became the foundation for the exploit chain.
The attack did not rely on malware, stolen credentials, or a vulnerability in WhatsApp itself. Instead, Guardio found multiple weaknesses in how the extension handled messages between web pages, its background service worker, and its WhatsApp integration component, known internally as “Hermes.”
According to the report, a malicious webpage could abuse web-accessible extension pages to send crafted messages that the extension mistakenly treated as trusted. Because the service worker failed to properly validate message origins, an attacker could modify the extension's local storage, enable developer-only feature flags, and activate the dormant WhatsApp integration.
The researchers then chained additional logic flaws to identify the victim's WhatsApp Web tab and send privileged Hermes commands directly to it. Those commands exposed broad capabilities, including manipulating the WhatsApp page's Document Object Model (DOM), interacting with browser storage, and invoking window and element operations.
Guardio
The proof-of-concept abused legitimate browser behavior to make WhatsApp Web submit its own rendered page content to an attacker-controlled server. That data could include contact names, chat lists, message previews, profile information, and the visible contents of the currently open conversation. Because the attack targeted rendered page content, newly displayed messages, including one-time passcodes delivered through WhatsApp, could also potentially be exposed.
Guardio emphasized that the attack required victims to have the vulnerable Adobe Acrobat extension installed and an active WhatsApp Web session. Users also needed to visit an attacker-controlled webpage crafted to trigger the exploit chain.
After validating the attack end-to-end, Guardio privately reported the findings to Adobe's Product Security Incident Response Team (PSIRT). The company acknowledged the report, developed a fix, and released an updated extension over the same weekend, with CVE-2026-48294 assigned shortly afterward.
Users should ensure they are running the latest version of the Adobe Acrobat Chrome extension. As a general security practice, keeping browser extensions updated, removing extensions that are no longer needed, and limiting the number of extensions with broad permissions can significantly reduce exposure to attacks.
Leave a Reply