More than 314 million users — and a tracked flaw, CVE-2026-48294 — were exposed to a now-patched chain that could let a malicious web page read a victim’s WhatsApp Web session through the Adobe Acrobat Chrome extension.
HermeticReader, CVE-2026-48294: scope and severity
Guardio Labs has codenamed the issue HermeticReader. The vulnerability is officially tracked as CVE-2026-48294 and carries a CVSS score of 7.4. Guardio describes it as a universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability affecting the Adobe Acrobat extension (extension ID efaidnbmnnnibpcajpcglclefindmkaj) in all versions prior to and including 26.5.2.2. The chain has since been patched, according to the disclosure shared with The Hacker News.
How the exploit chain can silently read WhatsApp Web
Guardio Labs lays out a short, scripted sequence an attacker can follow once a target with the vulnerable extension visits an attacker-controlled page. The steps, as described by the researchers, are:
- An attacker-controlled page calls an iframe element loaded from the extension’s resources.
- The iframe sends commands to alter settings to activate the Hermes engine — the extension component that handles WhatsApp integration when a specific feature flag ("floodgate-add") is enabled.
- The attacker page opens WhatsApp Web in a background browser tab.
- The iframe obtains the WhatsApp tab’s numeric ID and sends commands directly to the Hermes engine targeting that tab.
- The engine manipulates WhatsApp Web by injecting a POST form into WhatsApp’s DOM that causes the rendered page text to be sent to an attacker-controlled endpoint.
Guardio Labs researcher Shaked Biner summarized the practical result: once the page "wakes up a dormant engine inside the extension, reaches directly into WhatsApp Web. Seconds later, the rendered WhatsApp Web view — the chat list, contact names, messages, the profile name, the text of whatever conversation is open — the whole WhatsApp in the attacker’s hands."
Crucially, the chain does not require the attacker to install malware, phish credentials, or extract session cookies; the only prerequisite is user interaction — convincing the victim to visit the crafted URL or interact with a compromised page.
Two unexpected HTML/CSP behaviors that enable exfiltration
Biner points to two underappreciated behaviors in web standards and implementation that make the final exfiltration step possible. First, an option element without a value attribute submits its text content, and that text is the concatenation of everything rendered beneath that node — so moving the live document body into such an element can turn an entire rendered page into a form field value.
Second, WhatsApp Web’s content security policy (CSP) at the time of the research included no form-action directive. Under the HTML specification, that absence allows a top-level form submission to navigate to any origin. As Biner explained, "So WhatsApp itself performs the navigation, POSTing its own rendered DOM to our controlled endpoint and then dutifully rendering whatever we send back."
Patch status and what data could be exposed
The flaw chain has been patched following Guardio’s disclosure. Versions of the Adobe Acrobat Chrome extension up to and including 26.5.2.2 were affected. Exploitation can yield cross-origin read access to session-bound data, which Guardio demonstrates can include WhatsApp Web’s rendered chat list, contact names, message previews, the profile name, and the visible text of an open conversation.
What this means for WhatsApp Web users, Adobe/extension maintainers, and security teams
- WhatsApp Web users: Even authenticated web sessions can be subject to exfiltration if a browser extension with a privileged integration point is present and a user visits a crafted page. The attack requires only that the victim interact with the malicious page.
- Adobe and extension maintainers: The vulnerability surfaces how a feature flag and a dormant engine (the Hermes engine for WhatsApp integration) can be leveraged by composition attacks. Guardio’s finding emphasizes the need to treat extension resource access and feature-flagged components as potential attack surfaces.
- Security teams and technologists: The chain illustrates the risk of "plumbing-level" composition — trusted components interacting in unexpected ways. Defenders should be aware that cross-origin read risks can arise from combinations of extension-internal APIs, feature flags (for example "floodgate-add"), and subtle HTML/CSP behaviors.
Guardio concluded with a broader, pointed judgment: "Composition is the threat. Plumbing-level flaws compose into building-level collapse, and the bigger the install base, the longer the building stands before anyone checks the joints." The HermeticReader chain is a concrete example: a common extension, an obscure engine, and two permissive behaviors in web standards combined to expose highly sensitive, session-bound messaging content — and the result depended not on credential theft but on a single, well-timed page visit.
