Week 30 – A PDF Extension with a WhatsApp Obsession

20 -26 July 2026

In this week’s CVE of the Week, we’re examining a recently patched vulnerability chain in the Adobe Acrobat PDF Chrome extension, which is used by more than 314 million users worldwide. Tracked as CVE-2026-48294 (CVSS score: 8.2) and dubbed HermeticReader by researchers at cybersecurity firm Guardio, the flaw represents a universal cross-site scripting (UXSS) vulnerability that could lead to a silent hijack of a user’s WhatsApp data.

This vulnerability can allow an attacker to bypass the browser’s same-origin policy and gain access to data associated with the victim’s active session. Exploitation requires only limited user interaction, as the victim must be persuaded to visit a specially crafted URL or a compromised webpage that triggers the vulnerable functionality in the extension. Notably, the attack does not rely on malware installation, credential theft, or session cookie extraction. Instead, simply visiting the malicious webpage can be sufficient to trigger the exploit and expose sensitive data.

The entire sequence of actions is as follows:

• An attacker-controlled page calls an iframe element loaded from the extension resources.
• The iframe sends commands to alter settings to activate the Hermes engine, which handles WhatsApp integration in the extension only if a specific feature flag is enabled (“floodgate-add”).
• The attacker page opens WhatsApp Web in a browser tab in the background.
• The iframe sends commands directly to the engine directed against the WhatsApp tab after obtaining the tab’s numeric ID.
• The engine manipulates WhatsApp Web’s by injecting a POST form into WhatsApp’s DOM to steal WhatsApp data.

As a result, a threat actor can exploit HermeticReader to capture the rendered chat list, contact names, message previews, the profile name, and the visible text of the open conversation.

The issue has been addressed in version 26.5.2.3, which was automatically delivered to users.

The vulnerability was identified just four hours after Adobe inadvertently introduced it through an extension update. Following responsible disclosure, Adobe responded swiftly and released a fix within 48 hours.

Although there is currently no evidence that the flaw has been exploited in the wild, users are strongly advised to verify that they are running the latest version to ensure they remain protected.

For additional information about the CVE, please visit:
https://cvefeed.io/vuln/detail/CVE-2026-48294
https://guard.io/labs/hermeticreader—the-vulnerability-that-turned-adobe-300m-install-extension-into-a-full-whatsapp-takeover
https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html

White Hat IT Security is a Europe-based Managed Security Services Provider (MSSP) and proud Microsoft Solution Partner. Its Microsoft-verified managed security solutions (MXDR) reflect their deep expertise and commitment to excellence in cybersecurity. The company was awarded the Partner of the Year Hungary Award by Microsoft in 2024 and 2025.

With the largest incident response capacity in the CEE region, they’re trusted by organizations to deliver fast, effective, and proactive protection. Their portfolio includes penetration testing, vulnerability assessments, managed Cyber Threat Intelligence, as well as Governance, Risk and Compliance (GRC) consulting and specialized security training.

They are committed to supporting professional initiatives that aim to raise cybersecurity awareness and maturity—both for individuals and organizations. They regularly contribute to the community through knowledge sharing, education, and outreach, helping to build a safer digital future for all.