Adobe Acrobat Extension Flaw Leaked WhatsApp Chats, Patched

A significant security flaw in the Adobe Acrobat extension for Google Chrome, used by over 314 million people, could have allowed attackers to silently steal a user's WhatsApp Web chats simply by having them visit a malicious webpage. The vulnerability, now patched, has been disclosed by cybersecurity researchers at Guardio Labs.

The flaw, tracked as CVE-2026-48294 with a severity score of 7.4, is classified as a universal cross-site scripting (UXSS) vulnerability. It allowed a malicious website to bypass the browser's same-origin policy and read data from a victim's active session in another tab, specifically targeting WhatsApp Web. The attack required no malware installation, credential theft, or even a click from the user beyond visiting a booby-trapped page.

Researchers detailed that an attacker could craft a landing page disguised as a legitimate site from search results or marketing emails. If a victim with the vulnerable Adobe Acrobat extension installed-versions 26.5.2.2 and earlier-had WhatsApp Web open in a separate tab and then visited the malicious page, the exploit would trigger. A dormant integration engine within the extension, internally called "Hermes," would be...