Full research report
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Executive assessment
CVE-2026-48294 (HermeticReader) is a UXSS-class vulnerability in the Adobe Acrobat Chrome extension affecting roughly 329 million installations, discovered by Guardio Labs researcher Shaked Biner within hours of a June 2026 Adobe update. The attack chains three weaknesses — unauthenticated URL-parameter processing in a web-accessible iframe, unauthenticated service-worker storage writes, and activation of a dormant Hermes WhatsApp integration engine — to achieve cross-origin DOM exfiltration from WhatsApp Web without any script execution in WhatsApp's origin. Adobe patched the issue in version 26.5.2.3 within a single weekend after responsible disclosure, and no exploitation in the wild has been confirmed by any source. The EPSS score of 0.0072 (50th percentile) is consistent with the low-likelihood-of-exploitation-in-30-days assessment given the rapid patch and absence of public exploit code, though the low technical bar for a motivated attacker (a single social-engineered page visit) keeps the residual risk meaningful for unpatched endpoints.
What happened
Guardio Labs researcher Shaked Biner discovered a three-stage vulnerability chain in the Adobe Acrobat PDF Chrome extension, dubbed HermeticReader and tracked as CVE-2026-48294. The flaws were identified within hours of Adobe shipping version 26.5.2.1 on 3 June 2026, and Adobe patched the issue in version 26.5.2.3 over the same weekend. The CVE was formally published on 17 June 2026. There is no evidence of exploitation in the wild prior to or following disclosure.
Affected scope
Adobe Acrobat PDF Chrome extension (extension ID: efaidnbmnnnibpcajpcglclefindmkaj), all versions up to and including 26.5.2.2, across approximately 329 million browser installations. Any user with the extension installed and WhatsApp Web open in a concurrent tab was potentially vulnerable to cross-origin session data exposure.
Technical assessment
The attack chains three discrete weaknesses: (1) the extension exposes a web-accessible internal iframe resource that parses and acts on JSON passed via URL query parameters without validating the caller's origin; (2) the extension's service worker accepts storage-write commands without authenticating the sender, enabling an attacker page to toggle a feature flag that activates the dormant Hermes WhatsApp integration engine; (3) once active, Hermes accepts DOM manipulation commands — including tab targeting via predictable monotonic tab IDs — allowing injection of a POST form directly into WhatsApp Web's document. WhatsApp Web's Content Security Policy omits a form-action directive, so per specification the absence permits top-level navigation to any origin; submitting the form causes WhatsApp's own renderer to POST its rendered DOM — including chats, contacts, and profile data — to an attacker-controlled endpoint. No script execution within WhatsApp's origin is required.
Recommended defensive actions
- Verify that the Adobe Acrobat Chrome extension is at version 26.5.2.3 or later on all managed endpoints; Chrome auto-update should have applied the patch but confirmation via enterprise inventory is advisable.
- If the extension is not operationally required, disable or remove it via Chrome enterprise policy to eliminate the attack surface entirely.
- Review browser extension allowlists and enforce a policy of least-privilege: block web-accessible extension resources from being loaded cross-origin where Chrome enterprise controls permit.
- Monitor network egress for unexpected form POST submissions originating from web.whatsapp.com to external domains, which would be an observable indicator of this specific exfiltration technique.
Uncertainties and evidence gaps
- No official Adobe APSB security bulletin page was confirmed accessible during research; NVD references the Chrome Web Store listing rather than a dedicated advisory URL, leaving the formal vendor advisory status unclear.
- A minor version discrepancy exists between sources: Guardio Labs and BleepingComputer reference 26.5.2.1 as the introduced-vulnerable release, while NVD and The Hacker News state the affected ceiling is 26.5.2.2; the authoritative fixed version (26.5.2.3) is consistently reported.
- The Guardio Labs disclosure notes the vulnerability was found using an AI-driven analysis system; the completeness of Adobe's internal review to rule out analogous weaknesses in other extension components is unknown.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active exploitation confirmed in the wild; working end-to-end proof-of-concept demonstrated privately by Guardio Labs prior to disclosure but no public exploit code released
Investigation began with the supplied THN reporting and EPSS data for CVE-2026-48294, then moved to locate the primary researcher disclosure from Guardio Labs to establish the authoritative technical account. Two independent secondary sources (BleepingComputer, SecurityWeek) were fetched to corroborate exploitation status and the fixed version. The NVD record was fetched to confirm CVSS scoring and formal CVE metadata. Attempts to confirm an official Adobe APSB advisory page timed out, leaving the formal vendor bulletin unverified. The assembled evidence supports high confidence: the vulnerability is real, patched, and not yet exploited in the wild.
- What are the primary sources and corroborating outlets reporting on CVE-2026-48294 / HermeticReader?Searched for 'CVE-2026-48294 Adobe Acrobat Chrome extension HermeticReader Guardio Labs' and 'Adobe Acrobat extension UXSS WhatsApp Web data theft 2026'
Identified Guardio Labs as the originating researcher; located BleepingComputer, SecurityWeek, Security Affairs, and SentinelOne CVE DB as independent secondary sources alongside the supplied THN article
why Established the source landscape and confirmed multiple independent outlets, enabling triangulated verification of claims
- What are the precise technical details, timeline, and researcher attribution?Fetched Guardio Labs primary research postguard.io ↗
Three-stage chain confirmed: unauthenticated iframe URL-parameter parsing, unauthenticated service-worker storage write to enable Hermes engine, then cross-origin DOM injection via predictable tab IDs; vulnerable version introduced 3 June 2026, patched same weekend; researcher is Shaked Biner; working PoC confirmed in-lab, not publicly released
why Primary source establishes authoritative technical account and confirms no public exploit code
- Is there active exploitation in the wild, and what is the confirmed fixed version?Fetched BleepingComputer independent reportingbleepingcomputer.com ↗
No active exploitation detected; fixed version confirmed as 26.5.2.3 delivered automatically via Chrome Web Store; patch turnaround was two days over a weekend
why Independent corroboration of exploitation status from a well-regarded outlet directly cited BleepingComputer's communication with Guardio principal researcher Nati Tal
- Does a second independent source confirm scope and impact?Fetched SecurityWeek reportsecurityweek.com ↗
Confirmed ~329 million affected browsers; noted Guardio published a video demonstration; characterised exploitation as requiring only social engineering to visit a page
why Second independent corroboration across a separate publication domain, satisfying the two-domain requirement
- What do the formal CVE records say about CVSS scoring, CWE classification, and affected version ceiling?Searched for NVD record then fetched itnvd.nist.gov ↗
CVSS 3.1 Base Score 7.4 HIGH (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), CWE-79, affected versions ≤26.5.2.2, published 17 June 2026, last modified 29 June 2026; no vendor advisory URL listed beyond Chrome Web Store link
why NVD is the authoritative scoring record; absence of a vendor advisory URL prompted the follow-up Adobe bulletin search
- Is there an official Adobe APSB security bulletin for this CVE?Searched for Adobe helpx.adobe.com advisory pages (apsb26-43 and apsb26-63) and attempted to fetch both
Both Adobe helpx.adobe.com advisory pages timed out; neither could be confirmed as covering CVE-2026-48294; no APSB bulletin URL verified
why Vendor advisory status remains unconfirmed; noted as a material uncertainty in the assessment
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok10 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| BleepingComputernews | ok11 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| FIRST EPSSepss | ok6991 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1653 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok11 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1583 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Vulnerability & exploitation1
PoC & exploit code1
Primary researcher write-up detailing the three-stage vulnerability chain with attack mechanics; no exploit code released publicly
Vendor & gov advisories1
Official CVE record confirming CVSS 7.4, CWE-79, affected versions ≤26.5.2.2, published 17 June 2026
Analysis & research2
Independent corroboration confirming fixed version 26.5.2.3 and no exploitation detected in the wild
Second independent corroboration; confirms video demonstration of data theft published by Guardio