Adobe Acrobat Chrome extension flaw exposes private WhatsApp Web chats

The record

Written from the 2 reports below. Nothing here is unsourced.

Researchers at Guardio Labs disclosed a now-patched vulnerability, codenamed HermeticReader (CVE-2026-48294), in the Adobe Acrobat Chrome extension, which has over 314 million users.
The flaw let a malicious webpage silently read a victim's WhatsApp Web data, including chats, contact names, and profile details, without needing malware, phishing, or session cookies.
Exploitation required the victim to visit an attacker-controlled page while having the vulnerable extension installed.
The issue affected extension versions up to and including 26.5.2.2 and has been fixed.

Ensure the Adobe Acrobat extension is updated beyond version 26.5.2.2.
Watch for similar browser-extension flaws that exploit cross-origin access to web apps.
Monitor Adobe for any further advisories on extension security fixes.

Every report on this story, newest first. Times are when each outlet published.

2 reports

English national1International1

Filed from India ×1, United States ×1

Named India · Adobe Acrobat Chrome Extension · Chrome · WhatsApp · WhatsApp Web · Adobe · Guardio · Guardio Labs · Nati Tal · Shaked Biner

The 2 reports are listed beside the record.

Answers cite the reports above, or say they can't.