"an unauthenticated, single-visit, zero-click write into the extension's own storage from any web page." — Guardio Labs
HermeticReader (CVE-2026-48294): a short chain, broad reach
Researchers at Guardio disclosed a vulnerability chain they call HermeticReader and tracked as CVE-2026-48294 that could let attackers access WhatsApp Web conversations via the Adobe Acrobat extension for Chrome. Exploitation, Guardio says, requires only that a user with the vulnerable extension visit a web page under an attacker’s control; no additional clicks, authentication or session cookies are required. The affected extension versions are 26.5.2.1 and below, and Adobe issued a fix in 26.5.2.3.
How the Hermes integration engine was abused
The exploitation path pivots on the Acrobat extension’s WhatsApp integration, which Adobe implements with an internal component named Hermes. Hermes is an integration engine that remains dormant until a specific feature flag is set in the extension’s internal storage. Once activated, Hermes can accept requests, open PDFs shared through WhatsApp, and issue scripts that manipulate the WhatsApp tab’s Document Object Model (DOM).
Guardio’s writeup explains that the extension exposed an internal HTML resource that any web page could include as an iframe. The page accepted commands via a URL parameter and forwarded them to the extension’s service worker — the extension backend possessing elevated permissions — without verifying whether the command originated from an Adobe content script or a foreign page. Using a predictable Tab ID and this command path, an attacker could redirect the extension’s privileged DOM operations into a WhatsApp Web tab and run a script against the messaging interface.
What data could be taken and how the demo worked
Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the live page body into an <option> element and submitting that form to an attacker-controlled server. Because an option element without a defined value submits its text content, and because WhatsApp’s content security policy reportedly lacked a form-action restriction, the browser sent the rendered page text — including the chat list, contact names, messages, profile name and conversation content — to the attacker’s endpoint.
The researchers emphasize that only messages already loaded and rendered in the page were exposed; content not yet rendered by WhatsApp Web was not included in the leak. Guardio also outlined a second, higher-friction scenario in which the same DOM-control capability could replace WhatsApp’s device-linking QR code to enable account takeover, but that attack would require the victim to scan the substituted QR code.
Patch, scope and vendor response
Adobe fixed the vulnerability in version 26.5.2.3 and delivered the update automatically to users, though Guardio recommends that end users verify they have the latest release installed. Guardio’s principal researcher, Nati Tal, told BleepingComputer that the team saw no indication of active exploitation for CVE-2026-48294. Tal also said Guardio discovered the flaw roughly four hours after Adobe introduced it in an update and that Adobe released a patch within two days, over a weekend.
Guardio commended Adobe’s rapid response and noted the urgency given the extension’s reach: according to Guardio’s statement in the report, the Acrobat extension is “installed on roughly 329 million browsers.” Adobe acknowledged the flaw to Guardio and, per the researcher, told them the vendor generally does not publish security bulletins for consumer products even as it addressed the issue.
What this means for technologists, enterprises, and end users
- Technologists and security teams — Verify that Chrome instances under your control have the Adobe Acrobat extension updated to 26.5.2.3. The vulnerability involved the extension’s service worker and internal storage, so review extension permissions and any enterprise policies that allow third-party extensions to be installed broadly.
- Enterprises and procurement leaders — Note that the flaw required only a single-visit web baiting step and did not rely on session cookies, increasing the exposure of users who run the extension in corporate browsers. Confirm mitigations and patch rollout status for managed browser fleets.
- End users — If you run the Adobe Acrobat extension for Chrome, check that your extension is on version 26.5.2.3. Avoid visiting untrusted pages while running browser extensions with broad integration features, and treat unexpected QR code prompts in messaging apps with caution — scanning a substituted QR code is the extra step an attacker would need for account takeover.
Guardio’s disclosure and Adobe’s swift patch closed an exploit chain that combined an exposed internal resource, unchecked messaging to a service worker, and a privileged integration engine able to script WhatsApp Web. The immediate risk appears mitigated for patched users, but the incident underscores how browser extensions that bridge external services can create high-impact attack paths when internal safeguards are incomplete.
