Adobe’s Patch Leaves WhatsApp’s Own Security Gap Untouched

Adobe has fixed a Chrome extension bug that let any website silently read a visitor’s WhatsApp Web chats. The vulnerability chain, called HermeticReader and tracked as CVE-2026-48294, needed no password, no session cookie, and no click beyond opening the wrong page. It sat inside the Acrobat extension installed on roughly 329 million browsers, according to cybersecurity firm Guardio.

Adobe owns the patch and the CVE number. The step that actually pushed private chats out of the browser ran through a security setting inside WhatsApp Web itself, one Meta has never fixed or even acknowledged publicly.

Hermes Wakes Up

Adobe built a WhatsApp Web integration into the Acrobat Chrome extension in April 2026, powered by an internal engine called Hermes. Hermes stays inactive by default, waiting for a feature flag buried in the extension’s internal storage before it does anything.

Once triggered, Hermes can open a PDF shared inside WhatsApp and send commands to whichever browser tab is running WhatsApp Web, reaching directly into the page’s structure to pull it apart and reassemble it. That privilege, meant to make opening a shared PDF smoother, is what an outside website learned to hijack.

Shaked Biner, the Guardio Labs researcher who wrote up the disclosure, described the setup as almost comically mundane: a page dressed to look like an ordinary search result or marketing link. A visitor only had to load it while signed into WhatsApp Web in the same browser. No download, no phishing form, no fake login screen.

Three Chained Bugs Open the Door

Guardio traced the exploit to three separate weaknesses in the extension that only became dangerous once chained together, producing what the firm called an unauthenticated, single visit, zero click write into the extension’s own storage from any web page.

• An open iframe: the extension ships an internal HTML resource that any page on the internet can embed inside an iframe, no permission required.
• An unverified command channel: that resource reads commands from a URL parameter and hands them to the extension’s service worker without checking whether the command actually came from Adobe’s own content script.
• A guessable Tab ID: by supplying a predictable identifier, an attacker’s page could pass its commands off as legitimate internal messages, switch on the WhatsApp integration, and redirect the extension’s privileged DOM controls straight into a WhatsApp Web tab.

Researchers classify the flaw as a universal cross site scripting issue, a bug category that lets one site reach past the browser’s normal separation between tabs. It carries a CVSS severity score of 7.4, in the high band on the industry’s ten point scale.

Adobe Shipped a Fix in a Single Weekend

Guardio’s account of the timeline reads like a rare case of the system working the way it is supposed to.

1. April 2026: Adobe adds the WhatsApp Web integration to the Acrobat Chrome extension, built on the Hermes engine.
2. June 3, 2026: Adobe ships the vulnerable build, version 26.5.2.1, to the Chrome Web Store.
3. Hours later: Guardio’s team flags the exploit chain, using an AI assisted research harness that had already unpacked hundreds of the extension’s obfuscated JavaScript files.
4. The following weekend: Adobe acknowledges the report, builds a fix, and ships version 26.5.2.3 automatically to users.
5. Days later: CVE-2026-48294 is formally assigned.
6. July 23, 2026: Guardio and BleepingComputer publish the full technical breakdown.

Nati Tal, Guardio’s lead researcher, told BleepingComputer his team discovered the flaw roughly four hours after Adobe pushed the vulnerable update, and that Adobe turned around a fix within two days, over a weekend.

WhatsApp Did the Leaking Itself

Getting Hermes to point at a WhatsApp Web tab only opened a door. Walking the data out required a separate trick that lived inside WhatsApp’s own code.

Guardio injected a form into the WhatsApp Web page, then used the hijacked DOM controls to move the page’s entire visible content into an option element inside that form. An option element with no defined value submits its own text when a form is sent, and Guardio then submitted the form to a server it controlled.

That submission should have failed. A content security policy is a browser rule that lets a site restrict where its own forms are allowed to send data, and it is supposed to stop exactly this kind of cross origin post. WhatsApp Web’s policy has never included a form-action rule, so the browser had no instruction to block it.

We never asked the extension to read anything. We asked WhatsApp to submit itself to us.

That is how Guardio Labs described chaining three separate extension bugs into one exfiltration path in its technical write-up. The data that left included chat lists, contact names, message previews, profile names, and whatever conversation happened to be open on screen. Messages that had not loaded on the page stayed out of reach.

A Clumsier Path to Account Takeover

Guardio also mapped a second use for the same hijacked DOM controls: swapping WhatsApp’s device linking QR code for a fake one under the attacker’s control.

Scanning that substituted code with a phone would hand over the entire account, not just whatever chat happened to be open. The trick only works if the victim actively scans it, which adds a step of participation the data theft method never needed. Guardio called it less practical for that reason and said it saw no evidence either scenario was used against real victims before the patch shipped.

WhatsApp’s Missing CSP Directive Is Not New

The gap Guardio exploited this month is not the first time a researcher has found a hole in WhatsApp Web’s content security policy. In 2020, a researcher identified in reporting only by the surname Weizman was examining WhatsApp Web’s policy with Google’s CSP evaluator tool while chasing a separate flaw, tracked as CVE-2019-18426, and found the object-src directive missing entirely.

“I can use object to load an iframe to any origin of my choice,” the researcher wrote at the time, according to security outlet Threatpost, describing how the gap let a persistent cross site scripting bug reach further than it should have.

Two different researchers, six years apart, found two different missing directives in the same product’s security policy, and both became the final ingredient in someone else’s exploit chain. The table below breaks down how the accountability for HermeticReader actually splits between the two companies involved.

Meta has publicized other WhatsApp safety work this year, including an on-device system that flags scam messages without reading their content. That messaging has not extended to the CSP gap HermeticReader exploited, and Meta has said nothing about it.

What Should Acrobat Extension Users Do Now?

Anyone running the Adobe Acrobat Chrome extension should confirm it has updated to version 26.5.2.3 or later, since the fix closes all three chained bugs at once and Chrome does not always restart extensions the moment a patch lands.

• Open Chrome and type chrome://extensions into the address bar.
• Turn on Developer Mode with the toggle in the top right corner so version numbers become visible.
• Find Adobe Acrobat in the list and check the version number against 26.5.2.3.
• If the version reads 26.5.2.1 or lower, open the Chrome menu, choose Extensions, then Manage Extensions, and click Update to force the download.
• Restart Chrome completely, then check the version number again to confirm it took.
• If the WhatsApp integration was never used, remove the extension entirely from the Manage Extensions page as an added precaution.

The patch reaches most installs automatically through the Chrome Web Store, though a base above 329 million browsers always takes time to fully turn over. The WhatsApp side of the equation is still an open question with no public answer.

Frequently Asked Questions

Does the HermeticReader Flaw Affect WhatsApp’s Mobile App?

No. The bug lived entirely inside the Chrome desktop extension and could only reach a WhatsApp Web tab open in that same browser session. WhatsApp’s mobile apps for iOS and Android never connected to Acrobat’s extension code and sat outside the exposure completely.

Is a Missing CSP Directive the Same Thing as a Software Bug?

Technically, no. A content security policy is a configuration a site chooses to set, separate from the code Adobe can patch directly. WhatsApp Web’s policy has never included a form-action rule, leaving the browser with no instruction to block the page from submitting its own content elsewhere.

Could Other Browser Extensions Trigger the Same WhatsApp Weakness?

Yes, in theory. Any extension able to inject a form into WhatsApp Web and submit it would run into the identical missing form-action rule, since the gap sits in WhatsApp’s policy rather than in Adobe’s code specifically. Guardio says it has not identified another extension attempting the trick.

How Serious Is a CVSS Score of 7.4?

A 7.4 falls in the high severity band on the industry’s ten point scale, one tier below critical. Researchers scored HermeticReader that high because it needed no authentication and no user interaction beyond a page visit, even though it could only capture messages already loaded on screen.