Security researchers have disclosed a vulnerability in the Adobe Acrobat PDF extension for Chrome that could have let attackers silently read a victim’s open WhatsApp Web conversations simply by getting them to visit a booby-trapped webpage — no downloads, credential theft, or suspicious clicks required. Given that the extension ships on an estimated 314 to 329 million browsers worldwide, the flaw represented one of the broader privacy exposures uncovered in a mainstream browser extension this year.

A Dormant Feature Turned Into an Attack Path

The flaw, nicknamed “HermeticReader” by the Guardio Labs researchers who found it and formally tracked as CVE-2026-48294 with a CVSS score of 7.4, is classified as a universal cross-site scripting (UXSS) bug. In plain terms, it allowed a malicious site to break out of the browser’s normal isolation rules and reach into data tied to a completely different tab — in this case, an open WhatsApp Web session.

What makes the discovery notable is that the exploited functionality wasn’t even an active, advertised feature. Buried inside the extension was a dormant WhatsApp Web integration engine, internally referred to as “Hermes,” that Guardio’s researchers found could be switched on by an attacker without the user’s knowledge.

How the Attack Chain Worked

The exploit unfolded in a sequence of quiet, individually unremarkable steps. First, a hidden iframe embedded in the malicious page communicated with the extension’s background service worker — a component that, critically, never verified who was actually sending it messages. That gap allowed the attacker to write arbitrary data into the extension’s local storage, flipping a hidden flag that activated the dormant Hermes engine.

From there, the malicious page opened WhatsApp Web in a background tab and guessed its numeric tab identifier by taking advantage of how Chrome assigns tab IDs sequentially. Once it had that ID, the attacker could send commands straight to Hermes’s content script running inside the WhatsApp tab, manipulating the page’s structure at will.

The final step required no injected scripts to actually execute. Instead, the compromised engine planted a hidden form on the WhatsApp Web page and used ordinary, legitimate browser operations to relocate the live chat contents into that form. Because a hidden field inside the form lacked a proper “value” attribute, submitting it caused the browser to transmit the entire visible page — chat lists, contact names, message previews, and any open conversation — directly to a server controlled by the attacker. WhatsApp Web’s content security policy didn’t restrict where forms could submit data, so the browser allowed the cross-origin transfer without complaint.

What Was and Wasn’t Exposed

Guardio’s researchers were careful to note an important nuance: the data captured was limited to on-screen, rendered text rather than WhatsApp’s underlying encrypted message payloads. For most users, though, that’s a technical distinction with little practical comfort — the visible content of their conversations is, for all intents and purposes, the sensitive material they’d want protected in the first place.

A Fast Fix From Adobe

To its credit, Adobe moved quickly once Guardio’s team reported the issue through its PSIRT process. The company acknowledged, fixed, and shipped a patch in version 26.5.2.3 within a single weekend, with the formal CVE assignment following days later. Because the fix was distributed automatically through the Chrome Web Store, most users should already be protected, though security teams are advised to confirm that installed extension versions are current rather than assume the update applied silently.

A Bigger Pattern in Browser Extensions

Beyond the specifics of this one bug, the HermeticReader case highlights a growing category of risk: individually minor weaknesses in how extensions pass messages, validate storage writes, and gate feature flags can combine into a full account-level compromise chain. That risk scales dramatically in extensions with install bases in the hundreds of millions.

As more browser extensions build direct integrations with messaging platforms and other sensitive services, the unglamorous “plumbing” code connecting those pieces — rather than headline-grabbing zero-days — is emerging as one of the more consequential attack surfaces for both individual users and the organizations whose employees rely on these tools daily.