Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
A critical UXSS vulnerability (CVE-2026-48294, CVSS 7.4) in the Adobe Acrobat Chrome extension allows cross-origin data disclosure. The flaw enables attackers to silently hijack WhatsApp Web sessions by injecting DOM elements and exploiting HTML form submission behaviors. Exploitation requires only user interaction with a malicious page, bypassing same-origin policies without needing malware installation or credential phishing. The attack leverages a dormant "Hermes engine" within the extension
Analysis
TL;DR
- A critical UXSS vulnerability (CVE-2026-48294, CVSS 7.4) in the Adobe Acrobat Chrome extension allows cross-origin data disclosure.
- The flaw enables attackers to silently hijack WhatsApp Web sessions by injecting DOM elements and exploiting HTML form submission behaviors.
- Exploitation requires only user interaction with a malicious page, bypassing same-origin policies without needing malware installation or credential phishing.
- The attack leverages a dormant "Hermes engine" within the extension to manipulate background tabs and exfiltrate chat data via POST requests.
Why It Matters
This incident highlights the severe security risks posed by widely installed browser extensions, particularly when they possess broad permissions and complex internal architectures. For AI practitioners and developers, it underscores the necessity of rigorous input validation and strict content security policy enforcement in any system that interacts with web DOMs or handles sensitive user data across origins.
Technical Details
- Vulnerability Type: Universal Cross-Site Scripting (UXSS) leading to cross-origin data disclosure.
- Affected Component: Adobe Acrobat Chrome extension (ID: efaidnbmnnnibpcajpcglclefindmkaj), versions prior to and including 26.5.2.2.
- Attack Vector: An attacker-controlled page loads an iframe from the extension resources, activating the "Hermes engine" via specific feature flags.
- Data Exfiltration Mechanism: The engine injects a POST form into WhatsApp Web's DOM. By leveraging HTML specifications where an
<option>element submits its text content if no value is defined, the entire rendered page text is submitted to an attacker-controlled endpoint. - Bypass Conditions: The attack succeeds because WhatsApp Web’s Content Security Policy lacks a
form-actiondirective, allowing top-level form submissions to navigate to any origin.
Industry Insight
- Extension Security Auditing: Organizations must treat third-party browser extensions as high-risk components, requiring regular audits for permission misuse and complex inter-extension communication patterns.
- Defense in Depth: Relying solely on same-origin policies is insufficient; applications like WhatsApp Web should enforce strict
form-actiondirectives in CSPs to prevent unauthorized data exfiltration via form submissions. - Supply Chain Vigilance: The "plumbing" of large software ecosystems often contains overlooked vulnerabilities; continuous monitoring and patching of even minor extensions are critical given their massive install bases.
Disclaimer: The above content is generated by AI and is for reference only.