Adobe Flaw Exposes WhatsApp Web Chats

A newly disclosed vulnerability, dubbed HermeticReader (CVE-2026-48294), in Adobe's Acrobat PDF extension for Chrome briefly put millions of users at risk by exposing WhatsApp Web conversations. Discovered by security researchers in June 2026, the flaw was patched by Adobe within days.

The vulnerability allowed a malicious website to abuse the Acrobat extension's elevated browser privileges, bypassing Chrome's same-origin security protections. If users had the vulnerable Adobe Acrobat extension installed and an active WhatsApp Web session open, attackers could potentially access chat lists, contact names, profile details, messages, and the contents of open conversations-without exploiting WhatsApp itself, installing malware, or stealing login credentials.

The issue affected Windows, macOS, Linux, and ChromeOS devices running Chrome or other Chromium-based browsers with the vulnerable extension enabled. Since the extension had been installed on an estimated 329 million browsers, the potential impact was significant.

Adobe has resolved the issue in Acrobat PDF extension version 26.5.2.3, eliminating the vulnerability. Users should ensure the extension is updated, review devices linked to their WhatsApp accounts, remove unnecessary browser extensions, and keep all software current.

The incident underscores the security risks posed by browser extensions, whose elevated permissions can inadvertently become gateways to sensitive personal data if vulnerabilities are exploited.