Flaw in Adobe Extension With 300M Installs Enabled WhatsApp Data Theft
The Adobe Acrobat Chrome extension contained a UXSS vulnerability (CVE-2026-48294) allowing silent data theft from WhatsApp Web without malware or credential compromise. Attackers exploited a lack of security checks in the extension's internal messaging system via a hidden frame to activate a dormant integration engine named Hermes. Once activated, the Hermes engine bridged the extension to WhatsApp Web, enabling the scraping of private chats, contacts, and account details in plain text. The vul
Analysis
TL;DR
- The Adobe Acrobat Chrome extension contained a UXSS vulnerability (CVE-2026-48294) allowing silent data theft from WhatsApp Web without malware or credential compromise.
- Attackers exploited a lack of security checks in the extension's internal messaging system via a hidden frame to activate a dormant integration engine named Hermes.
- Once activated, the Hermes engine bridged the extension to WhatsApp Web, enabling the scraping of private chats, contacts, and account details in plain text.
- The vulnerability affected approximately 329 million browsers and was patched by Adobe in June after being reported by security firm Guardio.
Why It Matters
This incident highlights the critical security risks associated with third-party browser extensions, particularly those from major vendors with widespread adoption. It demonstrates how legitimate features, such as dormant integration engines, can be weaponized through UXSS vulnerabilities to bypass standard browser security models and access sensitive user data across different domains.
Technical Details
- Vulnerability Type: UXSS-class cross-origin data disclosure (CVE-2026-48294).
- Attack Vector: A malicious webpage uses a hidden frame to trick the Adobe Acrobat extension into accepting unverified commands due to insufficient security checks in its internal messaging system.
- Mechanism: The exploit writes to the extension’s local storage to activate "Hermes," a dormant integration engine.
- Data Exfiltration: Hermes bridges the connection to WhatsApp Web, allowing the attacker to invisibly scrape private chats, contacts, and account details in plain text.
- Scope: The Adobe Acrobat Chrome extension is installed on approximately 329 million browsers.
Industry Insight
- Extension Security Audits: Vendors must rigorously audit internal messaging systems and permission scopes in browser extensions, ensuring that dormant features are not easily activatable by untrusted origins.
- Defense in Depth: Users should be aware that even trusted extensions can pose significant privacy risks if they possess broad permissions; regular review of installed extensions and their permissions is essential.
- Supply Chain Vigilance: Security teams should monitor for vulnerabilities in widely used third-party tools, as the scale of installation amplifies the potential impact of a single flaw.
Disclaimer: The above content is generated by AI and is for reference only.