Adobe Acrobat Chrome extension cross-context WhatsApp data access (HermeticReader)
CVE-2026-48294: cross-context flaw in the Adobe Acrobat Chrome extension let any site silently read WhatsApp Web data. CVSS 7.4; patched by Adobe.
- Vendor
- Adobe
- Product
- Adobe Acrobat Chrome Extension
- CVSS
- 7.4
- EPSS (exploit probability)
- 1.2%
- Status
- patched
- Published
Is CVE-2026-48294 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48294 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
A vulnerability chain in the Adobe Acrobat Chrome extension — installed on over 314 million browsers — allowed any website to silently read WhatsApp Web conversations and data without user authentication or visible notification. Guardio Labs discovered and reported the flaw, naming the chain HermeticReader.
Mechanism: The Adobe Acrobat extension requests broad page-access permissions to detect and open PDF files. The HermeticReader chain exploited how those permissions were scoped across tab contexts, allowing a page in one context to initiate reads against data rendered in a separate WhatsApp Web session. The attack required no user interaction beyond having both the extension installed and WhatsApp Web open simultaneously.
Affected scope: All Adobe Acrobat Chrome extension versions prior to the patched build. The extension had more than 314 million installs at time of disclosure.
Impact: Silent access to WhatsApp Web conversations, contacts, and media as rendered in the browser’s decrypted view. No bypass of WhatsApp’s end-to-end encrypted transport — the exposure was at the rendering layer.
Remediation: Adobe has patched the vulnerability. Update the Adobe Acrobat extension to the current version via the Chrome Web Store. Users who disabled the extension pending a fix may re-enable the updated version. See the NVD record for CVE-2026-48294 and full coverage at Adobe Acrobat Extension Let Sites Read WhatsApp Chats.
Sources: NVD — CVE-2026-48294 | The Hacker News / Guardio Labs, July 22, 2026 | BleepingComputer, July 22, 2026
Other Adobe CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-71362 Incorrect Authorization in Adobe Commerce and Magento Open Sourcewrite-up | [ CRITICAL ] | 9.1 | 87.5% | |
| CVE-2026-75650 Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)write-up | [ CRITICAL ] | 10.0 | 3.9% | |
| CVE-2026-48449 Adobe Campaign Classic Incorrect Authorization Enables RCEwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
