Vulnerability in Adobe Acrobat Chrome Extension Allowed Theft of WhatsApp Web Conversations
A serious vulnerability in the Adobe Acrobat extension for Chrome allowed malicious web pages to silently extract conversations, contacts, and profile data from active WhatsApp Web sessions.
The flaw, identified as CVE-2026-48294 and dubbed HermeticReader, received a CVSS score of 7.4. It impacted every version of the extension up to 26.5.2.2 and was present in roughly 329 million browser installations.
Exploitation required only that a victim with the extension installed and a logged-in WhatsApp Web session visit an attacker-controlled address. No malware installation, password entry, or file clicks were necessary.
The attack chain leveraged internal pages reachable from the extension together with the absence of message-origin validation. The malicious site altered local storage to activate the Hermes integration feature originally built to connect Acrobat with WhatsApp Web.
By determining the numeric identifier of the open Chrome tab, the attacker could issue commands directly to the Acrobat component loaded inside WhatsApp Web. Visible page elements were manipulated and their rendered content copied into a hidden form that was then submitted to the attacker’s server.
Exposed information included contact names, the full list of conversations, message previews, the user’s profile name, and the complete text of any open chat. End-to-end encryption of the messaging service remained unbroken throughout the process.
Adobe released a fix in version 26.5.2.3, which was distributed automatically via the Chrome Web Store. At the time of disclosure, researchers had found no public indications that the vulnerability had been used in real-world attacks.
Related articles
Cache Key Injection Flaw in Nginx Configurations Allows Access Bypass, Data Disclosure and Cached Denial of Service
Security researcher Alex Brumen from YesWeHack has detailed a Cache Key Injection attack vector that exploits poorly constructed cache keys in Nginx. The issue arises when administrators concatenate variable-length values without delimiters, such as $scheme$host$request_uri$http_accept, allowing different requests to produce identical cache keys. Attackers can poison the cache with 404 responses to deliver CPDoS, expose restricted pages like /admin by manipulating path components, or even achieve stored XSS by colliding HTTP and HTTPS responses. The technique can also bypass Cloudflare protection when the Authorization header routes requests directly to the vulnerable Nginx cache. Mitigation requires using explicit delimiters or structured encoding in cache keys, validating the Host header, enforcing HTTPS redirects, and avoiding caching of authenticated requests.
Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link
Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.
CISA Adds Three Actively Exploited Linux Kernel Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added three vulnerabilities affecting the Linux Kernel to its Known Exploited Vulnerabilities catalog. The flaws, identified as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are confirmed to be under active exploitation in the wild. CISA is directing all federal agencies to apply patches immediately and to search for indicators of compromise. The vulnerabilities impact the kernel's kTLS TLS processing, the ebtables network bridge component, and the AF_ALG cryptographic interface. Each issue can lead to memory corruption or inconsistent internal state that attackers may leverage for privilege escalation or remote code execution.
Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A team deployed Keycloak for 25,000–30,000 users across a country using three isolated VMs instead of Kubernetes. They chose Embedded Infinispan with JGroups over an external cluster to reduce failure points and maintain session replication. PostgreSQL with Patroni handled shared storage and JDBC_PING discovery. Testing revealed that full datacenter outages triggered split-brain conditions and 5xx errors that the built-in healthcheck could not resolve. The engineers wrote a Python watcher script to detect multiple coordinators in the JGROUPS_PING table and restart affected containers. They reported the recovery bug to the Keycloak project, which was confirmed and fixed in a later release. The production cluster now survives single-DC loss without session loss.