Published July 23, 2026.

Adobe has patched CVE-2026-48294, a flaw in its Acrobat Chrome extension — installed by over 314 million users — that let any malicious web page silently read a victim's WhatsApp Web data. It is a UXSS-class cross-origin disclosure bug rated CVSS 7.4; update the extension past version 26.5.2.2 now.

What happened. Researchers disclosed CVE-2026-48294, a universal cross-site-scripting (UXSS) class cross-origin data disclosure vulnerability in the Adobe Acrobat PDF extension for Chrome (versions 26.5.2.2 and earlier). A booby-trapped page could invoke an iframe from the extension's own resources, wake the extension's dormant WhatsApp-integration component, open WhatsApp Web in a background tab, and inject a form into WhatsApp's DOM to exfiltrate the rendered chat list, contact names, message previews, the profile name, and the text of the open conversation — with no prompt to the user beyond visiting the page. Adobe has shipped a fix.

How does CVE-2026-48294 steal WhatsApp data?

The extension trusted content across a security boundary it should not have. An attacker-controlled page loads a resource from the extension, which holds privileges the page itself lacks, and uses it to reach into WhatsApp Web running in the same browser. Because the extension's WhatsApp integration was reachable cross-origin, the malicious page could read what should have been isolated to web.whatsapp.com.

Which versions are affected and fixed?

What to do now.

• Update the Adobe Acrobat Chrome extension to the version released after 26.5.2.2 (open chrome://extensions, enable Developer mode, and click Update).

• Audit which extensions can touch sensitive web apps — an extension installed for PDFs should not be able to read your messaging sessions.

• For managed fleets, force the extension update and review extension permissions in your browser-management policy.

Who's affected. Anyone running the Adobe Acrobat Chrome extension at 26.5.2.2 or earlier who also uses WhatsApp Web in the same browser — a population drawn from the extension's 314 million-plus install base.

Our read. The detail worth pausing on is that a PDF extension carried a dormant engine able to reach into WhatsApp — attack surface most users never knew they had installed. Every extension is code running with elevated privileges next to every site you visit; the trust boundary is invisible until it fails. You cannot patch what you have not inventoried, which is why verifying the actual extension estate on your endpoints — not assuming it — is the control that closes this class.

Frequently asked questions

Is CVE-2026-48294 being exploited in the wild? There is no confirmed in-the-wild exploitation reported at publication, and the flaw is now patched, but the low barrier (a single malicious page) makes prompt updating important.

Why does a PDF extension have access to WhatsApp at all? The Acrobat extension shipped a dormant WhatsApp-integration component; the flaw let an unrelated web page reach it across origins. It is a clear case of extension feature-bloat expanding the attack surface.

Which browsers are affected? The vulnerability is in the Chrome extension specifically; Chromium-based browsers running the same extension build should update once the fixed version is available to them.

How do I know if my extension is patched? Check the version at chrome://extensions; anything at or below 26.5.2.2 is vulnerable and should auto-update to the fixed build.

Reporting by The Hacker News and SecurityWeek; CVSS and affected-version detail per the NVD record. Sources linked above. Related: our note on a Chrome extension that could read Gmail.