Cybersecurity 1 h agoAdd to bookmarks
A flaw in the Adobe Acrobat browser extension allows malicious sites to read the victim's WhatsApp Web data - a classic Same-Origin Policy bypass via a privileged extension.
A chain of vulnerabilities now fixed in the Adobe Acrobat extension for Chrome - which has over 314 million users - allowed a malicious website visited by the victim to silently access WhatsApp Web data: contact list, ongoing conversations, potentially message history.
The flaw was named HermeticReader by researchers at Guardio Labs, who disclosed it after it was fixed.
The attack exploits the fact that a browser extension, particularly an extension with broad permissions (<all_urls> or similar), can read and write to the DOM of any tab. A logical flaw in the extension's code allowed a third-party page to inject context that the extension executed with its own privileges - bypassing the Same-Origin Policy (SOP), the fundamental rule that prevents evil.com from reading the cookies of whatsapp.com.
1. Check that the Adobe Acrobat extension is up to date via chrome://extensions - the fixed version is already distributed. 2. If you are not using the Acrobat integration in the browser: uninstall it (it only serves to open PDFs in Acrobat Reader instead of in the built-in viewer). 3. Audit the list of your extensions: each extension with 'Read and change all your data on all websites' is a potential bypass of the SOP.
This type of incident illustrates a recurring problem: browser extensions are a weak link in web security. They enjoy privileges that no page code could obtain (access to all tabs, cookies, headers), but they are maintained with far fewer resources than those allocated to the browsers themselves or the target sites.
The irony of the scenario: the Same-Origin Policy protects WhatsApp Web against all theft attempts from other web origins. But it does not protect WhatsApp Web against an extension installed by the user with broad permissions - and it is this implicit trust that is betrayed here.
The fact that the extension affects 314 million users gives the scale of the risk: each flaw in this scope equates, in potential, to massive silent compromise. Adobe has pushed the fix - this is the expected behavior, but the fundamental question remains: how many other widely deployed extensions carry equivalent bugs that have never been discovered?
For the user, the rule is simple and painful: installing an extension = extending the attack surface of all web services you use. Chrome's "strict" mode (Manifest V3, more granular permissions) reduces the risk a bit but does not eliminate it - a bug in an extension with granted permissions remains a bug with granted permissions.
For extension developers: treat every postMessage, every DOM event, every HTML insertion from a third-party page as a hostile input. It's the same hygiene as for a web service exposed on the Internet.
Key takeaways
Article produced by artificial intelligence, reviewed under human editorial control.