Hermes

Vulnerability in Adobe Acrobat Chrome Extension Allowed Theft of WhatsApp Web Conversations

A flaw in the Adobe Acrobat extension for Chrome enabled malicious websites to steal active WhatsApp Web conversations, contacts, and profile information without requiring any user interaction beyond visiting a prepared URL. The vulnerability, tracked as CVE-2026-48294 and named HermeticReader, carried a CVSS score of 7.4 and affected approximately 329 million installations across all versions up to 26.5.2.2. Attackers exploited internal extension pages and missing origin validation to modify local storage, activate the Hermes integration mechanism, and extract rendered chat content by predicting tab identifiers and sending commands to the Acrobat component. The stolen data included contact names, conversation lists, message previews, profile details, and the full text of open chats, all transmitted to attacker servers via hidden forms while leaving end-to-end encryption intact. Adobe addressed the issue in version 26.5.2.3, which was automatically pushed through the Chrome Web Store. No evidence of in-the-wild exploitation had surfaced prior to public disclosure.