Full Report
Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data. The shortcoming has been codenamed HermeticReader by Guardio Labs. It's officially tracked as CVE-2026-48294 (CVSS score: 7.4), with the vulnerability
Analysis Summary
# Vulnerability: Adobe Acrobat Extension UXSS (HermeticReader)
## CVE Details
- **CVE ID:** CVE-2026-48294
- **CVSS Score:** 7.4 (High)
- **CWE:** Universal Cross-Site Scripting (UXSS) / Cross-Origin Data Disclosure
## Affected Systems
- **Products:** Adobe Acrobat Chrome Extension
- **Extension ID:** efaidnbmnnnibpcajpcglclefindmkaj
- **Versions:** All versions prior to and including 26.5.2.2
- **Configurations:** Systems where the extension is active and the "floodgate-add" feature flag is enabled.
## Vulnerability Description
The vulnerability, dubbed **HermeticReader**, is a vulnerability chain that allows for a silent hijack of user data from third-party origins (specifically demonstrated with WhatsApp Web). The flaw resides in the extension's "Hermes" engine. An attacker can use an iframe to communicate with the extension's internal resources, manipulate settings to wake the dormant engine, and then command the engine to inject a malicious POST form into the DOM of a target tab (like WhatsApp).
The attack leverages two main components:
1. **HTML Specification Quirk:** Using an `<option>` element without a value attribute, which causes the browser to submit the entire concatenated text content of the node.
2. **Missing Security Policy:** WhatsApp Web's lack of a `form-action` directive in its Content Security Policy (CSP), allowing the injected form to POST the extracted data to an external attacker-controlled endpoint.
## Exploitation
- **Status:** PoC available (detailed by Guardio Labs)
- **Complexity:** Medium
- **Attack Vector:** Network (Web-based)
- **User Interaction:** Required (Victim must visit a malicious URL or interact with a compromised page).
## Impact
- **Confidentiality:** High (Full access to rendered chat lists, contact names, messages, and profile information).
- **Integrity:** Low (The primary impact is data theft; however, the engine can manipulate the DOM).
- **Availability:** None reported.
## Remediation
### Patches
- Adobe has released a patch to address this vulnerability. Ensure the Adobe Acrobat extension is updated to a version **newer than 26.5.2.2**. Chrome usually updates extensions automatically, but users should verify the version in `chrome://extensions/`.
### Workarounds
- If the extension cannot be updated immediately, it should be disabled or removed.
- Avoid clicking on suspicious links from untrusted search results or marketing emails.
## Detection
- **Indicators of Compromise:** Unusual POST requests originating from WhatsApp Web tabs to unknown or suspicious third-party domains.
- **Detection Methods:** Security teams can monitor for unauthorized cross-origin communications originating from browser extensions or use EDR tools to inspect browser sub-process behavior involving extension IDs.
## References
- Adobe Security Acknowledgements: hxxps[://]helpx[.]adobe[.]com/security/acknowledgements[.]html
- Guardio Labs Research: hxxps[://]guardio[.]com/blog (Implicit via report)
- NVD CVE Entry: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-48294
- Chrome Web Store - Adobe Acrobat: hxxps[://]chromewebstore[.]google[.]com/detail/adobe-acrobat-pdf-edit-co/efaidnbmnnnibpcajpcglclefindmkaj