Guardio Labs disclosed a vulnerability chain in the Adobe Acrobat Chrome extension that lets any attacker-controlled webpage silently steal WhatsApp Web chats, contacts, and message previews. The extension is installed on approximately 329 million browsers, and the attack requires no malware, no phished password, and no compromised session cookie.
The flaw chain, tracked as CVE-2026-48294, chains three separate weaknesses in the extension’s internal messaging system. First, the extension’s web-accessible resource pages can be embedded as hidden iframes by any website and relay JSON data directly to the extension’s service worker. The service worker’s message listener never checks the sender, allowing any page to write any key into the extension’s local storage.
That storage write activates Adobe’s Hermes engine, which handles WhatsApp Web integration. Once Hermes is armed, the attacker controls a command dispatcher inside the WhatsApp tab that can inject HTML and submit forms. The exploit injects a POST form into WhatsApp’s DOM and moves the entire page body into the form, submitting the rendered chat data to the attacker’s server. WhatsApp effectively exfiltrates itself.
Guardio found the vulnerability within hours of Adobe shipping version 26.5.2.1 on June 3, using a custom agentic AI system that unpacked and analyzed the extension’s 344 obfuscated JavaScript files. Adobe acknowledged and patched the issue within the same weekend, shipping the fix days after the report arrived.
