Summary
- CVE-2026-48294 allowed a hostile page to misuse privileged functions in Adobe’s Acrobat Chrome extension.
- The attack could retrieve rendered messages and contact information without stealing the WhatsApp session.
- Managed-browser controls need to account for extensions that can cross otherwise separate application boundaries.
A vulnerability in Adobe’s Acrobat extension for Google Chrome allowed a malicious website to read conversations and contact information displayed in an open WhatsApp Web session.
CVE-2026-48294 affected Acrobat extension versions up to and including 26.5.2.2 and carries a CVSS score of 7.4. Exploitation required the user to visit a hostile webpage while the vulnerable extension and WhatsApp Web were both available in the browser.
The attack abused privileged functions added to support an integration known internally as Hermes. A hostile page could load an extension resource in a frame, identify the browser tab running WhatsApp Web, and direct the extension to perform document-object-model operations against that tab.
Those operations could retrieve information already rendered in the browser, including parts of the chat list, contact details, profile information, and text from an open conversation. The attacker did not need to steal the user’s WhatsApp credentials, session cookie, or encryption keys.
Adobe has patched the flaw and published security bulletin APSB26-77. No exploitation in production environments has been reported.
WhatsApp’s end-to-end encryption was not broken. Encryption protects messages while they move between participants, but the recipient’s browser must decrypt and display the content. Software with privileged access to the rendered page can reach information after the cryptographic protection has completed its function.
A secure communications protocol therefore cannot protect content from every component running within the same endpoint and browser environment. Extensions can acquire permissions that cross boundaries between websites, files, tabs, and local applications, often through features that appear unrelated to the affected service.
Browser extensions are commonly installed for narrow productivity purposes but retain broad and persistent privileges. Their security lifecycle can differ from the browser itself, while updates may arrive automatically with limited visibility to central IT. A current operating system and browser can still carry exposure through an extension able to inspect or modify content across several services.
The use of WhatsApp Web adds a governance issue for organisations in which employees and contractors use personal or semi-managed messaging accounts for operational conversations, supplier contact, and rapid coordination. Information displayed in those sessions may sit outside conventional retention, monitoring, and data-loss controls even when it concerns company activity.
Managed-browser policy should identify which extensions are approved, the permissions they request, the devices on which they run, and whether their business value justifies access across multiple pages or tabs. Extensions that integrate with documents, identity, messaging, or cloud storage require particular scrutiny because they can become bridges between otherwise isolated services.
Automatic updating reduced the likely exposure period after Adobe issued the fix, although organisations still need to verify the installed extension version rather than assume every endpoint received it. Browser inventories, extension telemetry, and enforced update policy are necessary where users can postpone updates or operate unmanaged profiles.
CVE-2026-48294 required user interaction and exposed content available to the rendered session rather than an entire encrypted message history. The affected extension nevertheless held enough authority to cross from a document service into a separate communications application, placing the browser’s extension layer inside the security boundary of both.
