The Adobe Acrobat Chrome extension contained a UXSS-class cross-origin data disclosure vulnerability (CVE-2026-48294) that enabled attackers to exfiltrate WhatsApp chats and contacts without exploiting WhatsApp itself or requiring malware or compromised credentials. The attack, named HermeticReader, works by loading a malicious webpage that uses a hidden frame to send unverified commands to the extension, allowing silent writes to local storage and activation of Hermes, a dormant integration engine. Hermes connects to WhatsApp Web, enabling the attacker to scrape private WhatsApp data in plain text. The vulnerability was discovered and reported by Guardio and patched by Adobe in June 2026.

Exploitation of this vulnerability allows an attacker to silently steal a victim's WhatsApp messages, contacts, and account details in plain text by simply convincing the user to visit a malicious website. The attack does not require malware installation, credential compromise, or direct device access. This results in significant privacy breaches for affected users of the Adobe Acrobat Chrome extension.

Adobe released an official patch for this vulnerability in June 2026. Users of the Adobe Acrobat Chrome extension should ensure they have updated to the patched version. No additional user action is required beyond applying the update. Patch status is confirmed by the vendor advisory.