In short: In late July 2026 Guardio Labs disclosed HermeticReader (CVE-2026-48294, CVSS 7.4) — a flaw in the Adobe Acrobat extension for Chrome, installed in roughly 329 million browsers. Just visiting a malicious page while signed into WhatsApp Web let that page silently read your chat list, contacts and open conversation. Adobe patched it within days, and researchers saw no signs of real-world abuse — but the case shows how much a single trusted extension can quietly reach.
What happened?
Researchers at Guardio Labs found a chain of bugs in the official Adobe Acrobat browser extension for Chrome and named it HermeticReader. Tracked as CVE-2026-48294 with a CVSS score of 7.4, it is a universal cross-site scripting (UXSS) issue — a class of flaw that lets one website bypass the browser's same-origin policy and read data that belongs to another site.
The extension is installed in about 329 million browsers, which is what makes a mid-severity score so consequential. The attack needed no malware, no stolen passwords, no session cookies and no Adobe or WhatsApp account of the attacker's own — only a victim who had the extension installed and WhatsApp Web open in another tab. It is a close cousin of the extension-level data exposure we covered in our report on apps that quietly leak your data, and the defensive basics live on our blog.
How did the attack work?
According to Guardio, a malicious page could disguise its own commands as internal extension messages, because the extension did not properly verify who was talking to it. Through a hidden frame the page activated the extension's WhatsApp integration, opened WhatsApp Web in a background tab, and — abusing Chrome's predictable, sequential tab numbering — pointed the extension's privileged operations at that tab.
From there the attacker could read the rendered chat list, contact names, message previews, the profile name and the visible text of the open conversation. All of this happened without any visible sign to the user. Guardio's researcher noted they caught the flaw only about four hours after Adobe shipped the update that introduced it, and found no evidence it was ever exploited in the wild.
What it means for you and your data
The specific bug is fixed, but the lesson is broader: browser extensions run with sweeping access to everything you do on the web. A tool you installed years ago to open PDFs can, if it is flawed, become a window into your private messages. Extensions are software like any other — they have bugs, they get updates that introduce new bugs, and they are a favourite target because so many people trust them without a second thought.
That is why exposure of chat metadata matters even when "only" previews and contact names leak. Names, message snippets and who-talks-to-whom are exactly the raw material for convincing, personalised phishing — a message that quotes your real conversation is far harder to dismiss than generic spam.
How do I check and reduce my extension risk?
Open your browser's extensions page and remove anything you no longer use — every extension you keep is attack surface you carry. For the ones you keep, make sure automatic updates are on so fixes like Adobe's reach you quickly; in this case the safe build is version 26.5.2.3 or later. Be especially wary of granting "read and change all your data on all websites" to tools that do not truly need it.
How to protect yourself
Prune your extensions. Fewer, well-known extensions from reputable vendors mean fewer ways for a single flaw to reach your data.
Keep everything updated. The window of danger closes when the patch installs. Enable automatic updates for your browser and its extensions.
Turn on two-factor authentication. If message previews or contact data leak, 2FA still stands between an attacker and a full account takeover.
Cover the network layer. To be honest, a VPN cannot stop a malicious browser extension that already runs inside your browser — that is a device-side problem. But a VPN such as LiMP VPN encrypts your traffic on untrusted networks so it cannot be intercepted in transit, and hides your real IP from the sites you visit and your provider. It closes the network half of privacy — see how on our features page — while extension hygiene and 2FA close the rest.
Sources
This report is based on the technical write-up by Guardio Labs and coverage by The Hacker News, BleepingComputer and SecurityWeek (July 2026).