CVE-2026-48294Patch(adobe / acrobat)

HIGHCVSS 7.4 · HIGH

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch adobe acrobat systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

adobe CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://chromewebstore.google.com/detail/adobe-acrobat-pdf-edit-co/efaidnbmnnnibpcajpcglclefindmkaj

Weakness type (CWE)

CWE-79

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

acrobat

Threat summary

Active exploitation appears in 6 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
34 mentions across 12 observed days

What's happening

Active exploitation reported across 6 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 16 signals
Technical details provided in 25 signals
Disclosure: 13 classified signals
General: 4 classified signals
Peaked 10d ago at 10 mentions (2026-07-23); latest day: 1
34 total mentions across 12 days

Affected systems

Vendors

adobe

Products

acrobat

Deep dive

Activity timeline34 mentions / 12d

Signal classification5 categories

Patch

1441.2%

Disclosure

1338.2%

General

411.8%

Active Exploitation

25.9%

Exploit

12.9%

Referenced assets18 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-22	7	Active Exploitation1Disclosure4Patch2
2026-07-23	10	Active Exploitation1Disclosure1Exploit1Patch7
2026-07-24	4	Disclosure1General1Patch2
2026-07-25	1	Disclosure1
2026-07-28	2	Disclosure1Patch1
2026-07-31	1	Patch1
2026-08-05	1	Patch1
2026-08-13	4	Disclosure3General1
2026-08-23	1	General1
2026-08-25	1	Disclosure1
2026-08-27	1	Disclosure1
2026-08-29	1	General1

Full discourse20 posts

The Hacker News@TheHackersNews91d
Disclosure
🛑 One visit to a malicious webpage could have been enough to expose your #WhatsApp Web chats. CVE-2026-48294 in Adobe Acrobat’s Chrome extension could read messages, contact names, chat previews, and profile data without malware, stolen credentials, or session cookies. The extension has over 314 million users. See how HermeticReader worked: https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html
Post summary
Adobe Acrobat’s Chrome extension vulnerability (CVE‑2026‑48294) allows attackers to read WhatsApp Web chat information without malware, and a PoC—HermeticReader—is presented to demonstrate this exploitation.
71109328155118.4K
2.3M followersView on X
anu@0xCyrusObscura70d
Disclosure
@fantastixue Karena baru-baru ini ditemukan celah keamanan kritis bernama HermeticReader (CVE-2026-48294) pada ekstensi Adobe Acrobat PDF di browser berbasis Chromium seperti Google Chrome. Cukup buka satu situs yang salah saat tab WA Web aktif. Tanpa malware, tanpa password bocor, tanpa OTP.
Post summary
The tweet announces a newly discovered critical vulnerability (CVE-2026-48294) affecting the Adobe Acrobat PDF extension on Chromium browsers, noting it can be exploited simply by visiting a malicious site while WhatsApp Web is open, but no PoC, exploit code, or patch information is provided.
2032496.6K
221 followersView on X
anu@0xCyrusObscura70d
Disclosure
Saya coba jelaskan sedikit, kenapa ini bisa terjadi?? karena baru-baru ini ditemukan celah keamanan kritis bernama HermeticReader (CVE-2026-48294) pada ekstensi Adobe Acrobat PDF di browser berbasis Chromium seperti Google Chrome.
Post summary
The post reports the discovery of a new critical vulnerability, CVE‑2026‑48294, affecting the Adobe Acrobat PDF extension in Chromium‑based browsers, without providing technical details or mitigation information.
1301982.7K
221 followersView on X
anu@0xCyrusObscura70d
General
@kepleseeet Betul sekali, krna celah HermeticReader (CVE-2026-48294) di ekstensi Adobe Acrobat PDF ini bisa membuat situs jahat membaca isi WhatsApp Web, bahkan untuk mengambil alih akun, Tanpa malware, tanpa password bocor, tanpa OTP.
Post summary
The tweet warns that the CVE‑2026‑48294 flaw in Adobe Acrobat could let malicious sites read WhatsApp Web content and hijack accounts, without providing a PoC, exploit code, patch, or evidence of active exploitation.
2401484.2K
221 followersView on X
ThreatWire@ThreatWire_90d
Disclosure
🚨 CVE-2026-48294 A flaw in the Adobe Acrobat Chrome extension could let attackers steal WhatsApp Web chats contacts and profile data by simply luring victims to a malicious webpage UXSS vulnerability bypasses the browser’s same-origin policy to access data from active sessions. https://t.co/snSzP66MYM
Post summary
The tweet announces a new CVE‑2026‑48294 flaw in the Adobe Acrobat Chrome extension that allows a UXSS‑based same‑origin policy bypass to steal WhatsApp Web chat, contact, and profile data via a malicious webpage.
040175869
1.4K followersView on X
anu@0xCyrusObscura70d
Disclosure
@mbabumeng Bisa, karena baru-baru ini ditemukan celah keamanan kritis bernama HermeticReader (CVE-2026-48294) pada ekstensi Adobe Acrobat PDF di browser berbasis Chromium seperti Chrome. Cukup buka satu situs yang salah saat tab WA Web aktif. Tanpa malware, tanpa password bocor, tanpa OTP.
Post summary
The user announces the discovery of a critical flaw (CVE‑2026‑48294, HermeticReader) affecting the Adobe Acrobat PDF extension in Chromium browsers, explaining it can be triggered by visiting a malicious site while a WhatsApp Web tab is active. No PoC, exploit code, patch, or active exploitation claim is included.
20036789
221 followersView on X
Teegra 🧝‍♀️𝕏@Teeegra91d
Disclosure
محققان امنیت سایبری شرکت Guardio یک زنجیره آسیب‌پذیری خطرناک را در افزونه Adobe Acrobat برای مرورگر Chrome کشف کرده‌اند که با نام «HermeticReader» و شناسه CVE-2026-48294 ردیابی می‌شود. این آسیب‌پذیری به مهاجمان اجازه می‌دهد بدون نیاز به احراز هویت (authentication) و تنها با فریب کاربر برای بازدید از یک صفحه وب مخرب، به مکالمات و داده‌های WhatsApp Web دسترسی پیدا کنند. مهاجم می‌تواند با بهره‌برداری از موتور یکپارچه‌سازی داخلی افزونه موسوم به Hermes، دستوراتی را مستقیماً به تب WhatsApp ارسال کرده و از طریق دستکاری مدل شیء سند (DOM) اطلاعاتی نظیر لیست مخاطبان، پیام‌ها، نام پروفایل و محتوای مکالمات را به سرور تحت کنترل خود منتقل کند. در سناریویی دیگر، مهاجم می‌تواند کد QR مربوط به اتصال دستگاه را جایگزین کرده و حساب کاربری WhatsApp قربانی را تصاحب کند، هرچند این حالت مستلزم اسکن کد جعلی توسط قربانی است. این نقص امنیتی نسخه‌های ۲۶.۵.۲.۱ و پایین‌تر افزونه را تحت تأثیر قرار می‌دهد و Adobe ظرف دو روز پس از دریافت گزارش، حتی در طول آخر هفته، وصله امنیتی را در نسخه ۲۶.۵.۲.۳ منتشر کرد.
Post summary
Guardio researchers disclosed CVE‑2026‑48294, detailing a chain vulnerability in Adobe Acrobat’s Chrome plugin that allows unauthenticated attacks, while Adobe promptly released a patch.
00061548
19.4K followersView on X
vik ⚡️@vscorrpio91d
Patch
⚠️ quick OPSEC reminder for anyone trenching! the Adobe Acrobat Chrome extension (CVE-2026-48294) had a bug that let a malicious site abuse the extension to access data from other authenticated tabs. if you have it, update it NOW and you don’t need it, uninstall it. tbh, this applies to every non-essential extension. your trenching browser shouldn’t be loaded with random extensions you’ve accumulated over the years as every one of them runs privileged code inside the same browser you’re using to open completely untrusted token websites. more info on the vulnerability here: https://nvd.nist.gov/vuln/detail/CVE-2026-48294
Post summary
The message highlights a known Adobe Acrobat Chrome extension bug (CVE-2026-48294) that allows data exfiltration from authenticated tabs and urges users to update or uninstall to mitigate the risk.
21030331
175 followersView on X
Rıdvan Yağlı@ridvanyagli91d
Patch
🔴 Adobe Acrobat Chrome eklentisinde (CVE-2026-48294) kritik bir UXSS açığı yamalandı. 314 milyondan fazla kullanıcıyı etkileyen bu açık, kullanıcı yalnızca özel olarak hazırlanmış bir web sayfasını ziyaret ettiğinde istismar edilebiliyordu. Saldırgan, tarayıcının Same-Origin Policy korumasını aşarak arka planda açık olan WhatsApp Web sekmesine erişebiliyor ve WhatsApp Sohbet listesi, Kişi adları, Mesaj önizlemeleri, Profil adı, Açık sohbet mesajları gibi görünen verileri ele geçirebiliyordu. Bu saldırıda en önemli kısım; herhangi ek bir yazılım yüklenmesi, kimlik bilgisi hırsızlığı veya cookie çalınması gerekmemesiydi. Kullanıcının yalnızca kötü amaçlı hazırlanmış bir web sayfasını ziyaret etmesi yeterli oluyordu. Adobe, açığı CVE-2026-48294 olarak yamaladı. 26.5.2.2 ve önceki sürümleri kullananların eklentiyi güncellemesi öneriliyor.
Post summary
Adobe has patched CVE‑2026‑48294, a UXSS flaw in the Acrobat Chrome plugin that let attackers bypass Same‑Origin Policy and steal WhatsApp Web session data; the patch applies to versions up to 26.5.2.2.
00033616
2.3K followersView on X
TechNadu@TechNadu91d
Patch
A flaw in @Adobe's Acrobat Chrome extension (CVE-2026-48294) could let attacker-controlled websites access @WhatsApp Web data after a single visit. @GuardioSecurity Labs says the issue affected an extension installed on roughly 329 million browsers. Adobe has released a patched version.
Post summary
A newly disclosed flaw in Adobe Acrobat’s Chrome extension (CVE-2026-48294) could expose WhatsApp Web data; Adobe has issued a patch.
11021546
10.0K followersView on X
Cybersecurity News Everyday@TweetThreatNews91d
Disclosure
Adobe Acrobat Chrome extension flaw, CVE-2026-48294, could let malicious pages silently read WhatsApp Web data from victim sessions. Affects versions through 26.5.2.2. #AdobeAcrobat #WhatsAppWeb #CVE202648294 https://www.hendryadrian.com/adobe-acrobat-extension-flaw-let-malicious-sites-read-whatsapp-web-data/
Post summary
The post announces a new CVE (CVE-2026-48294) for the Adobe Acrobat Chrome extension that allows silent reading of WhatsApp Web data from victim sessions, affecting versions up to 26.5.2.2.
01020213
4.5K followersView on X
Cybersecurity News Everyday@TweetThreatNews91d
Patch
Adobe Acrobat's Chrome extension flaw let attackers silently steal WhatsApp chats, contacts, and account data via a malicious webpage. Guardio reported the HermeticReader attack, and Adobe patched CVE-2026-48294. #AdobeAcrobat #WhatsAppWeb https://www.hendryadrian.com/flaw-in-adobe-extension-with-300m-installs-enabled-whatsapp-data-theft/
Post summary
Guardio observed attackers exploiting a flaw in Adobe Acrobat’s Chrome extension to steal WhatsApp data; Adobe has issued a patch for CVE-2026-48294, indicating that the vulnerability has been addressed.
00030261
4.7K followersView on X
Snskies@Snskiesmedia58d
Disclosure
A security vulnerability has been identified in the Adobe Acrobat Chrome Extension that could allow malicious websites to access sensitive information from an active WhatsApp Web session. The vulnerability, tracked as CVE-2026-48294, affects Adobe Acrobat Chrome Extension https://t.co/B7FJCHJcSK
Post summary
The post announces the discovery of CVE-2026-48294 in the Adobe Acrobat Chrome Extension, noting it could let malicious sites read data from a user’s active WhatsApp Web session.
1001087
4 followersView on X
Red Secure Tech Ltd.@redsecuretech91d
Disclosure
Adobe Acrobat Chrome extension vulnerability leaks WhatsApp Web data. CVE-2026-48294 allows cross-origin access to chat lists and messages. For More: https://www.redsecuretech.co.uk/blog/post/adobe-acrobat-extension-flaw-leaks-whatsapp-data/1342 #AdobeAcrobat #ChromeExtension #CVE #WhatsApp #UXSS #DataLeak #GuardioLabs #InfoSec #CyberSecurity https://t.co/yR0DOcPBR1
Post summary
The post announces CVE-2026-48294 as a cross‑origin vulnerability in the Adobe Acrobat Chrome extension that leaks WhatsApp Web data, but it provides no PoC, exploit code, active use, or patch information.
0101076
69 followersView on X
Tech & Telecom by ProPakistani@ProPakTech56d
Disclosure
Tracked as CVE-2026-48294, the flaw affects extension version 26.5.2.2 and earlier. Attackers may access chat lists, contact names, message previews, open conversations and profile information.
Post summary
The post announces CVE-2026-48294, noting it impacts extension version 26.5.2.2 and earlier and allows attackers to access various private data such as chat lists and profile information.
1000031
72 followersView on X
Guardio@GuardioSecurity78d
Patch
Adobe moved fast: patched in a single weekend. CVE-2026-48294 was issued days later.
Post summary
Adobe quickly released a patch for CVE‑2026‑48294 within one weekend after the CVE was issued.
1000091
5.5K followersView on X
CyberWatch@CyberWatch0583d
Patch
JUST IN: A flaw in Adobe’s popular Acrobat Chrome extension (CVE-2026-48294) allowed malicious websites to silently steal rendered WhatsApp Web chats, contacts, and account details. The issue, dubbed HermeticReader, affected hundreds of millions of users and required only a visit to a malicious page. Adobe has released a patch. https://www.malwarebytes.com/blog/news/2026/07/whatsapp-web-chats-exposed-by-adobes-acrobat-extension-flaw
Post summary
Adobe disclosed a flaw in its Acrobat Chrome extension that enabled malicious sites to stealthily steal WhatsApp Web chat data; a patch has since been released to remediate the issue.
00010246
559 followersView on X
ProtAAPP - Protege las AAPP@ProtAAPP85d
Disclosure
Investigadores de Guardio Labs han descubierto una vulnerabilidad en la extensión de Adobe Acrobat para Chrome, con 314 millones de usuarios. La CVE-2026-48294 permite a atacantes acceder silenciosamente a datos de WhatsApp Web tras engañar al usuario… https://thehackernews.com/2026/07/adobe-acrobat-extension-flaw-let.html https://t.co/YMgLyYtczU
Post summary
Guardia Labs uncovered CVE-2026-48294, a flaw in the Adobe Acrobat Chrome extension that lets attackers silently exfiltrate WhatsApp Web data; no exploitation, patch, or PoC details are disclosed.
00010275
8.3K followersView on X
MAALTECH.pro@XINRAinc86d
Patch
https://organicemperor.com/2026/07/27/cve-2026-48294-adobe-fixes-high-severity-data-disclosure-vulnerability-in-acrobat-chrome-extension/
Post summary
Adobe has released a patch for CVE‑2026‑48294, a high‑severity data‑disclosure vulnerability in its Acrobat Chrome extension; no exploitation or PoC details were reported.
0001051
146 followersView on X
セキュリティ対策Lab@securityLab_jp90d
Patch
Adobe Acrobat Chrome 拡張機能の脆弱性「HermeticReader」(CVE-2026-48294)、WhatsApp Webの会話内容を丸ごと窃取可能に-3億2,900万ブラウザに影響、修正済み https://rocket-boys.co.jp/security-measures-lab/hermeticreader-cve-2026-48294-acrobat-extension/ #セキュリティ対策Lab #security #securitynews #脆弱性
Post summary
The article reports a patched vulnerability (CVE‑2026‑48294) in Adobe Acrobat’s Chrome extension, "HermeticReader," which allowed full theft of WhatsApp Web chat contents on over 329 million browsers.
00001202
493 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	acrobat	-	chrome	-

Explore more

Back to dashboard adobe CVEs acrobat vulnerabilities

What researchers are saying

CVE-2026-48294

ThreatWire[verified]@ThreatWire_Disclosure

The tweet announces a new CVE‑2026‑48294 flaw in the Adobe Acrobat Chrome extension that allows a UXSS‑based same‑origin policy bypass to steal WhatsApp Web chat, contact, and profile data via a malicious webpage.

Teegra 🧝‍♀️𝕏[verified]@TeeegraDisclosure

Guardio researchers disclosed CVE‑2026‑48294, detailing a chain vulnerability in Adobe Acrobat’s Chrome plugin that allows unauthenticated attacks, while Adobe promptly released a patch.

vik ⚡️[verified]@vscorrpioPatch

The message highlights a known Adobe Acrobat Chrome extension bug (CVE-2026-48294) that allows data exfiltration from authenticated tabs and urges users to update or uninstall to mitigate the risk.

Rıdvan Yağlı[verified]@ridvanyagliPatch

Adobe has patched CVE‑2026‑48294, a UXSS flaw in the Acrobat Chrome plugin that let attackers bypass Same‑Origin Policy and steal WhatsApp Web session data; the patch applies to versions up to 26.5.2.2.

Cybersecurity News Everyday[verified]@TweetThreatNewsDisclosure

The post announces a new CVE (CVE-2026-48294) for the Adobe Acrobat Chrome extension that allows silent reading of WhatsApp Web data from victim sessions, affecting versions up to 26.5.2.2.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

Guardio observed attackers exploiting a flaw in Adobe Acrobat’s Chrome extension to steal WhatsApp data; Adobe has issued a patch for CVE-2026-48294, indicating that the vulnerability has been addressed.

CyberWatch[verified]@CyberWatch05Patch

Adobe disclosed a flaw in its Acrobat Chrome extension that enabled malicious sites to stealthily steal WhatsApp Web chat data; a patch has since been released to remediate the issue.

MAALTECH.pro[verified]@XINRAincPatch

Adobe has released a patch for CVE‑2026‑48294, a high‑severity data‑disclosure vulnerability in its Acrobat Chrome extension; no exploitation or PoC details were reported.