Adobe WhatsApp Extension Flaw Exposes Private Chats
A newly discovered Adobe WhatsApp flaw exposed private conversations through the Adobe Acrobat Chrome extension. Researchers found that attackers could steal visible WhatsApp Web data after tricking users into visiting a malicious website. Fortunately, Adobe released a fix within days.
How the Vulnerability Worked
Cybersecurity researchers from Guardio uncovered the issue, called HermeticReader. The flaw affected Adobe Acrobat Chrome extension version 26.5.2.1 and earlier. It allowed malicious websites to send fake internal commands to the extension.
As a result, attackers could interact with WhatsApp Web without authentication. They could access contact names, chat lists, profile details, and visible messages. However, they could not retrieve conversations that were not loaded on the screen. Researchers also warned about another possible attack. Criminals could replace WhatsApp’s device-linking QR code with their own. If a victim scanned the fake code, attackers could link the account to another device.
Adobe Releases a Quick Fix
Adobe responded quickly after receiving the report. The company released version 26.5.2.3 within two days and fixed the security issue. Guardio praised Adobe for its fast action because the extension runs on hundreds of millions of browsers. Researchers found no evidence of active attacks before the patch became available. Even so, users should verify that their browser runs the latest extension version.
Security experts recommend updating extensions regularly and avoiding unknown websites. These simple habits reduce the risk of data theft and account compromise. Although this flaw is fixed, it reminds users that browser extensions can introduce serious security risks. Therefore, keeping software updated remains one of the best ways to protect personal information online.
