Просмотр новости
Найдите то, что Вас интересует
Спутники
РН
SpaceX
Роскосмос
NASA
Adobe Patches Acrobat Chrome Extension Flaw That Exposed WhatsApp Web Chats to Any Website
Дата публикации: 23-07-2026 08:40:30
Adobe has patched a series of vulnerabilities in its Acrobat Chrome extension that previously allowed any website to access conversations in WhatsApp Web withou
Thank you for being a Ghacks reader. The post Adobe Patches Acrobat Chrome Extension Flaw That Exposed WhatsApp Web Chats to Any Website appeared first on gHacks.
Основное содержимое страницы с новостью.
Adobe has patched a series of vulnerabilities in its Acrobat Chrome extension that previously allowed any website to access conversations in WhatsApp Web without proper authentication, according to a report from cybersecurity firm Guardio shared with BleepingComputer.
The vulnerabilities, collectively identified as CVE-2026-48294 and called HermeticReader, affect Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier.
Adobe addressed the issue in version 26.5.2.3, which is rolled out automatically, but Guardio advises users to verify that they are running the updated release.
Exploitation of the flaw required only that a user with the extension installed visit a malicious webpage. Guardio reports no signs that the vulnerability has been actively exploited.
How the Attack Worked and What Data Was ExposedThe Adobe Acrobat extension uses an integration engine called Hermes to manage interactions with WhatsApp Web. Hermes remains inactive until a feature flag is enabled in the extension's internal storage.
Once activated, it can open a PDF shared via WhatsApp and send commands to a tab running the messaging service, manipulating WhatsApp’s Document Object Model.
According to Guardio, HermeticReader exploits three vulnerabilities that together enable an unauthenticated, single-visit, zero-click write into the extension's own storage from any web page.
The extension includes an internal HTML resource that any page can embed as an iframe. This resource receives commands through a URL parameter, which is then passed to the extension's service worker without verifying whether the command originated from a legitimate Adobe content script.
By providing a predictable Tab ID, an attacker could disguise commands as internal extension messages, activate the WhatsApp integration, and redirect the extension's privileged DOM operations to a WhatsApp Web tab.
Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the page's live body into an option element, and submitting the form to an attacker-controlled server.
Since an option element without a specific value submits its text content, and WhatsApp's content security policy reportedly lacked a form-action restriction, the browser sent the page’s text to the attacker.
The exposed data included chat lists, contact names, messages, profile names, and conversation content. The attack did not require session cookies. Guardio notes that messages not loaded or visible on the page were not leaked.
Guardio also described a second scenario where an attacker could use the same DOM control functions to replace the WhatsApp device-linking QR code and take over the account. This method requires the victim to scan a substituted QR code, which adds significant complexity and makes it less practical than the data theft technique.
Disclosure Timeline and Steps to Take NowGuardio's lead researcher, Nati Tal, informed BleepingComputer that the company discovered the vulnerability just four hours after Adobe included it in an extension update. Adobe released a patch within two days, over a weekend. Guardio praised the quick response, noting that the extension is installed on roughly 329 million browsers.
Adobe told Guardio that it usually does not issue security bulletins for consumer products but made an exception in this case. Users of the Adobe Acrobat Chrome extension should verify they have the latest patched version, as the fix requires updating to version 26.5.2.3.
To do this, open Chrome and go to chrome://extensions in the address bar. Turn on Developer mode using the toggle in the top right corner to view extension version numbers.
Find Adobe Acrobat and check if the version is 26.5.2.3 or later. If it’s 26.5.2.1 or lower, open the Chrome menu, select Extensions, then Manage Extensions, and click Update to force an update. Restart Chrome after updating and verify the version again.
Users who do not use the WhatsApp integration or the extension itself can remove it from the Manage Extensions page as an extra precaution.
The patch in version 26.5.2.3 is delivered automatically to users. Guardio has not observed any exploitation of the vulnerability before the patch was released, but because of the extension's large user base, unpatched instances still pose a risk until the update spreads. Adobe has not issued a consumer security bulletin about the issue beyond confirming it to Guardio.
Схожие новости
Классификация: Пресс-релизы. Схожих патентов: 0. Схожих новостей: 10. Тональность: 0. Информативность: 3.93. Источник: www.ghacks.net.