Overview
- Researchers at Guardio discovered the vulnerability chain, named HermeticReader and tracked as CVE-2026-48294, after spotting risky code changes in an Acrobat extension update and responsibly reported the issue to Adobe.
- Adobe acknowledged the report and shipped a fix in Acrobat extension version 26.5.2.3 that was rolled out automatically after the June disclosure and later publicly detailed in reports published on Tuesday.
- The exploit used three linked weaknesses: Adobe’s web-accessible internal pages accepted attacker-controlled messages, the extension’s service worker wrote unchecked values into local storage to flip a feature flag, and the Hermes integration engine then injected HTML into a WhatsApp Web tab.
- Once Hermes controlled a WhatsApp tab, the attack moved the page’s live DOM into a form option and abused WhatsApp Web’s missing form-action content-security policy to make the site POST rendered chats, contacts, and profile data to an attacker endpoint.
- Guardio and multiple outlets say there is no evidence of active exploitation so far, but users should verify the Acrobat extension is updated to 26.5.2.3 or disable it, and developers should harden web-accessible pages, service-worker message checks, and web apps should add restrictive form-action CSPs.