A critical vulnerability in the Adobe Acrobat extension for Google Chrome allowed malicious websites to bypass authentication and directly read private WhatsApp Web chats, effectively nullifying the platform's end-to-end encryption within the browser.
Tracked as CVE-2023-44313, the flaw (identified in a BleepingComputer report) stemmed from the extension's insecure implementation of Chrome's powerful debugger API. This API grants deep, development-level access to browser tabs. Due to a misconfiguration, the extension inadvertently exposed unrestricted Document Object Model (DOM) access to any active tab, including the highly sensitive WhatsApp Web interface.
This created a direct attack vector. An attacker could lure a victim to a malicious webpage while the extension was running. Scripts on that page could then silently extract chat messages, contact details, and other rendered data from the WhatsApp Web tab, all without triggering any alerts or requiring additional authentication. This meant the encryption protecting messages in transit was rendered useless at the moment of display in the user's own browser.
The vulnerability underscored a systemic risk from over-permissioned browser extensions. It did not require compromising WhatsApp's servers—only exploiting a broad permission granted by a trusted vendor's extension.
Adobe has now patched the issue in version 23.10.204444. The fix disables the unsafe debugging feature by default, requiring users who previously enabled it for PDF functionality to explicitly opt-in again. This change correctly implements the principle of least privilege, shifting away from an insecure default state.
For the security community, this incident highlights that extensions from major developers must be treated as a critical attack surface. Regular audits of granted permissions are essential hygiene for both IT administrators and users. The case demonstrates how powerful capabilities intended for one purpose can have severe, unintended consequences for other web services, ultimately undermining trust in fundamental security guarantees.
Adobe Acrobat 的 Google Chrome 擴充功能中存在一個嚴重漏洞，允許惡意網站繞過驗證，直接讀取私人的 WhatsApp Web 聊天記錄，實質上廢除了該平台在瀏覽器內的端對端加密保護。
編號為 CVE-2023-44313 的漏洞（由 BleepingComputer 報導識別）源於該擴充功能對 Chrome 強大的 debugger API 進行了不安全的實現。此 API 提供對瀏覽器分頁進行深度、開發層級的存取權限。由於配置錯誤，擴充功能無意中向任何活動分頁暴露了不受限制的文檔物件模型（DOM）存取權限，包括極度敏感的 WhatsApp Web 介面。
這造成了一個直接的攻擊路徑。攻擊者可在擴充功能運作期間，引誘受害者訪問一個惡意網頁。該頁面上的腳本便能靜靜地從 WhatsApp Web 分頁中擷取聊天訊息、聯絡資料和其他已渲染的數據，整個過程不會觸發任何警報或需要額外驗證。這意味著保護傳輸中訊息的加密技術，在訊息於使用者自身瀏覽器中顯示的那一刻已形同虛設。
該漏洞突顯了權限過大的瀏覽器擴充功能所帶來的系統性風險。攻擊無需入侵 WhatsApp 的伺服器——只需利用一個受信任供應商擴充功能所授予的廣泛權限。
Adobe 已在版本 23.10.204444 修補此問題。修復措施預設停用了不安全的除錯功能，要求先前為 PDF 功能而啟用該功能的使用者必須再次明確選擇啟用。此更改正確實踐了最小權限原則，擺脫了不安全的預設狀態。
對安全社群而言，這次事件突顯了來自大型開發者的擴充功能必須被視為一個關鍵的攻擊面。定期審查已授予的權限，對於 IT 管理員和使用者而言都是必要的基本防護措施。此案展示了為特定目的而設的强大功能，如何可能對其他網路服務造成嚴重且意外的後果，最終削弱對基本安全保證的信任。