Adobe Acrobat Extension Let Sites Read WhatsApp Chats

The Adobe Acrobat extension for Chrome contained a flaw that let arbitrary websites access conversations and data rendered in WhatsApp Web — no authentication, no prompt, no visible indicator to the user whose messages were being read. BleepingComputer reported the issue on July 22, 2026. No CVE identifier had been assigned in the sources available at publication.

That’s a specific enough detail to parse carefully: not that a malicious site could target Adobe’s extension in some indirect way, but that any site could apparently use it to read what’s open in your WhatsApp Web tab. The extension’s job is to detect PDFs on web pages and offer to open them in Adobe’s viewer. To do that, it needs to read and interact with the content of pages you visit — which is why it requests broad browser permissions. The flaw meant that same access was reachable across tab contexts, including the live message view rendered by WhatsApp Web.

The Adobe Acrobat extension has tens of millions of Chrome installs. The overlap with WhatsApp Web users is large; the combination shows up on corporate laptops, shared home machines, and everything in between.

What to do now

Disable or remove the Adobe Acrobat extension from Chrome while waiting for a confirmed patch:

1. Open chrome://extensions/ and toggle off or remove the Adobe Acrobat extension.
2. Chrome’s built-in PDF viewer handles most documents without it. For files that need Acrobat-specific features, download the PDF and open it in Adobe Reader for desktop instead.
3. Watch Adobe’s security bulletins page for a CVE assignment and patch announcement. When a fixed version ships, re-enabling the updated extension is a low-friction recovery.

WhatsApp doesn’t expose an end-user indicator that session data was read by a third-party script or extension — there’s no “last accessed” log visible to account holders. If the extension has been installed for a while, you can’t know retroactively whether this was triggered on your account. Signing out all linked devices from your phone (WhatsApp → Settings → Linked Devices) forces a clean session state going forward.

The permission model problem

Browser extensions are structurally bad at containing this kind of issue. Chrome’s permission model grants an extension that legitimately needs to “read and change all your data on all websites” exactly that — on every website, including the ones that weren’t part of the extension’s design intent. Adobe’s extension isn’t unusual in needing those permissions; plenty of legitimately useful browser tools make the same request. What’s unusual is that the access apparently extended across tab contexts in a way that a separate site could initiate, which is where the security line is crossed.

Extension stores audit for what an extension does directly. They don’t routinely audit for cross-context data surfaces — the ways a sufficiently positioned page can reach sideways into what an extension holds. The developer can be reputable, the manifest benign, and the tool genuinely useful, and there can still be an exploitable surface that nobody looked at carefully enough. This is a category that keeps appearing, not because of a specific team’s failure, but because the permission architecture makes it structurally likely. The Azure DevOps MCP flaw disclosed this week lands in a similar neighborhood: trusted tools with broad access that can be reached sideways by a clever enough input.

The gap hasn’t closed. The answer, for now, is to carry fewer broad-permission extensions than you think you need, and treat anything with “all sites” access as a surface worth auditing when new flaws in adjacent software come to light.

Source: BleepingComputer, July 22, 2026