Adobe Patches ‘HermeticReader’ Flaw That Let Malicious Sites Read Your WhatsApp Web Chats

One of the most widely installed browser extensions on the planet was, until recently, sitting on a bug that could turn it into a silent spy on your private conversations. Adobe has patched a vulnerability — dubbed “HermeticReader” by the researchers who found it — in the Adobe Acrobat PDF extension for Chrome, a flaw that could have let any malicious website read a victim’s active WhatsApp Web chats, contacts and profile data without a single click, download or credential entered.

An extension installed on hundreds of millions of browsers

The Adobe Acrobat extension is one of the most common pieces of add-on software in existence, bundled or recommended alongside Adobe’s desktop products and installed by users who want to view or edit PDFs directly inside Chrome and other Chromium-based browsers. Researchers estimate it’s active on somewhere between 314 and 329 million browsers worldwide — a scale that turns even a moderately severe bug into a genuinely mass-impact security event.

The vulnerability, formally tracked as CVE-2026-48294 and carrying a CVSS severity score of 7.4 out of 10, was discovered by researchers at security firm Guardio Labs. It affected every version of the extension up to and including 26.5.2.2, and was classified as a universal cross-site scripting (UXSS) issue — a particularly dangerous bug class because it allows an attacker to bypass the browser’s same-origin policy, the fundamental security boundary that’s supposed to keep one website from reading data that belongs to a completely different site or tab.

How the attack actually worked

The root cause traces back to a feature most users never knew existed: a dormant integration inside the Acrobat extension, internally named “Hermes,” built to bridge Adobe’s extension with WhatsApp Web. The problem was that the extension’s internal messaging system didn’t properly verify who was allowed to send it commands.

Here’s the attack chain researchers laid out: a victim with the vulnerable extension installed visits an ordinary-looking but attacker-controlled webpage. A hidden iframe on that page sends a forged message to the extension’s background service worker — a message the extension should have rejected, but didn’t, because it never checked the sender’s identity. That forged message activates the dormant Hermes engine and, critically, supplies a predictable tab ID that lets the attacker’s commands get routed directly into the victim’s actual WhatsApp Web tab, if one happened to be open. From there, the attacker could silently direct the extension to scrape chat content, contact lists and account details in plain text — all without the victim clicking a single suspicious link, entering a password, or downloading any file.

The only real prerequisites were that a victim had to be running Chrome or another Chromium-based browser, have the vulnerable Acrobat extension installed and enabled, and land on the malicious page — something that could be accomplished through a phishing link, a malicious ad, or a compromised legitimate website.

A fast, weekend turnaround from Adobe

What stands out about this incident is the speed of the fix. Guardio’s researchers discovered the vulnerability shortly after Adobe pushed an update to the extension in early June, using an internal AI-assisted analysis tool that compares consecutive extension releases and flags newly introduced attack surfaces for manual validation. According to Guardio, they identified the flaw within roughly four hours of Adobe’s update going live — underscoring just how quickly both attackers and defenders can now move once new code ships.

After privately reporting the issue to Adobe’s Product Security Incident Response Team, Adobe developed and shipped a fix over the same weekend, releasing version 26.5.2.3 of the extension, which resolves the vulnerability and is delivered automatically to users through Chrome’s extension auto-update mechanism. Guardio publicly praised the speed of Adobe’s response, noting that a fix within days — over a weekend, no less — matched the urgency the flaw deserved given the extension’s massive install base. Both Adobe and Guardio have said they’ve seen no evidence that the vulnerability was actively exploited before it was patched.

Why this matters beyond WhatsApp

While WhatsApp Web was the specific integration exploited here, the underlying lesson extends well past one messaging app. Browser extensions routinely request broad permissions to operate — the ability to read and modify data on websites you visit, communicate with background scripts, and interact with other open tabs. Those permissions exist for legitimate functionality, but they also mean that a single vulnerability in a widely trusted extension can cascade into unauthorized access across whatever else happens to be open in your browser at the time.

This isn’t a hypothetical concern unique to Adobe. Any extension capable of injecting content or intercepting messages across tabs represents a similar theoretical attack surface if its internal authorization checks are ever found lacking. The HermeticReader case is notable mainly because of the scale of its install base and the fact that the vulnerable pathway connected two enormously popular pieces of software — a PDF reader and the world’s most widely used messaging platform — in a way few users would have ever anticipated.

What you should do

If you use the Adobe Acrobat extension for Chrome, here’s how to make sure you’re protected:

• Open Chrome’s extension manager by navigating to chrome://extensions in your address bar.
• Find “Adobe Acrobat: PDF edit, convert, sign tools” in the list and confirm the version reads 26.5.2.3 or later.
• If Chrome’s “Developer mode” toggle is off (the default for most users), extensions update automatically in the background, but you can force a check by toggling Developer mode on temporarily and clicking “Update” in the top-left corner of the extensions page.
• As a general practice, periodically review the full list of extensions installed in your browser and remove any you no longer actively use — every installed extension, active or not, is a potential vector like the one described here.

Why UXSS bugs are considered especially dangerous

Not every browser vulnerability carries the same weight, and it’s worth explaining why the “universal cross-site scripting” classification here is particularly serious. Ordinary cross-site scripting bugs typically let an attacker run malicious code within the context of a single vulnerable website — bad, but contained. A universal XSS vulnerability, by contrast, breaks the browser’s fundamental same-origin boundary itself, meaning the malicious code isn’t limited to one site’s context at all. In this case, that meant a script running on an entirely unrelated, attacker-controlled webpage could reach across tabs and interact with a completely different, trusted origin — WhatsApp’s own servers — as if it belonged there.

This is precisely why browser vendors and extension platforms treat cross-tab and cross-origin messaging systems with such caution, and why Guardio’s researchers described the flaw’s severity as matching the scale of the extension’s install base. A same-origin policy violation inside a widely trusted extension effectively hands an attacker the same access a legitimate first-party script would have — without requiring the attacker to compromise WhatsApp, Adobe’s servers, or the victim’s credentials at any point.

How researchers are finding these bugs faster than ever

The four-hour discovery window Guardio reported deserves its own mention, because it illustrates a broader shift happening across the security research industry in 2026. Guardio’s team used an internally built, AI-assisted analysis platform specifically designed to compare successive versions of browser extensions, automatically deobfuscate minified or obscured code, and flag newly introduced attack paths for a human researcher to manually validate. What might once have taken a skilled reverse engineer days or weeks of manual comparison between two extension builds can now happen in a matter of hours.

That acceleration cuts both ways. The same class of tooling that let Guardio catch this bug so quickly is, in principle, available to attackers as well — a dynamic that several of the researchers covering this story explicitly noted as a reason for urgency in Adobe’s response. It’s part of a wider pattern seen across multiple incidents this year, from Apple’s accelerated patch timelines to Microsoft’s record-breaking Patch Tuesday releases: the gap between a vulnerability being introduced and someone finding it, whether a defender or an attacker, keeps shrinking.

What extension developers can learn from this

For developers building browser extensions with any kind of cross-tab or background-messaging functionality, the core lesson from HermeticReader is straightforward but easy to overlook under deadline pressure: every message received by a background service worker needs to be treated as untrusted until its origin is explicitly verified, even messages that appear to come from the extension’s own web-accessible resources. The Hermes integration’s failure wasn’t a single catastrophic design flaw so much as a missing verification step in an otherwise reasonable feature — a pattern that shows up repeatedly across extension security incidents industry-wide.

Security researchers frequently recommend that extension developers apply the same zero-trust mindset to internal messaging that they’d apply to any public-facing API: authenticate the sender, validate the payload, and avoid granting a message the ability to trigger privileged actions like tab redirection or cross-origin data access based on its content alone.

The takeaway

HermeticReader is now fixed, and there’s no evidence anyone exploited it before Adobe’s patch went live. But the incident is a useful reminder that browser extensions — often installed once and then forgotten — sit at a uniquely privileged position in your daily digital life, frequently with access to far more than the single task they were installed to perform. Keeping extensions updated is exactly as important as keeping your operating system and browser itself current, and this incident is a fairly dramatic illustration of why.