A critical vulnerability in the widely used Adobe Acrobat Chrome extension has been patched after cybersecurity researchers found it could allow silent theft of private data from WhatsApp Web.
The shortcoming, officially tracked as CVE-2026-48294, was disclosed by researchers who warned that exploiting the flaw could facilitate a silent hijack of a user's WhatsApp data through a malicious PDF.
According to the disclosure, an attacker would first need to lure a victim to a malicious website hosting a specially crafted PDF. When opened using the Adobe Acrobat extension, the file could exploit a flaw in the extension's background service worker to gain persistent, elevated privileges within the browser.
This elevated access allowed the malicious code to bypass standard browser isolation, reaching into an open WhatsApp Web session. From there, it could read private messages, contacts, and other data, transmitting it to an attacker-controlled server without any visible alert to the user.
The potential privacy breach is significant, given WhatsApp Web's access to sensitive personal and business communications.
Adobe has released a fix for the vulnerability. Users are strongly advised to update their Adobe Acrobat Chrome extension to the latest version immediately through the Chrome Web Store. While extensions often auto-update, manual verification is recommended given the critical nature of this threat.
The discovery highlights the security complexities of modern browser extensions, which require deep integration and permissions to function. This incident demonstrates how a breakdown in an extension's permission controls can create vulnerabilities that span multiple web applications.
The event reinforces the shared responsibility for security: users must treat browser extensions as trusted software by keeping them updated and reviewing permissions, while developers should adopt rigorous audits and minimal-privilege practices. Vigilance from both sides is essential for maintaining a secure web ecosystem.
廣泛使用的 Adobe Acrobat Chrome 擴充功能中一個嚴重漏洞已被修補，此前網絡安全研究人員發現該漏洞可能導致 WhatsApp Web 的私隱數據遭悄無聲息地竊取。
此缺陷已被正式追蹤為 CVE-2026-48294，研究人員在披露時警告，利用該漏洞可能透過惡意 PDF 實現對用戶 WhatsApp 數據的靜默劫持。
根據披露內容，攻擊者首先需要將受害者引至託管特製 PDF 的惡意網站。當使用 Adobe Acrobat 擴充功能開啟該檔案時，它可利用擴充功能後台服務工作程序中的一個缺陷，以在瀏覽器內獲取持久的提升權限。
這種提升的訪問權限使惡意代碼得以繞過標準瀏覽器隔離機制，直接存取已開啟的 WhatsApp Web 會話。由此，它可以讀取私人訊息、聯絡人及其他數據，並將其傳輸至攻擊者控制的伺服器，而用戶不會收到任何可見提示。
鑒於 WhatsApp Web 能訪問敏感的個人及商業通訊，潛在的私隱洩露風險極為嚴重。
Adobe 已針對此漏洞發布修復程式。強烈建議用戶立即透過 Chrome 網上應用程式商店將其 Adobe Acrobat Chrome 擴充功能更新至最新版本。儘管擴充功能通常會自動更新，但鑒於此威脅的嚴重性，建議進行手動驗證。
此發現突顯了現代瀏覽器擴充功能的安全複雜性，這些擴充功能需要深度整合和權限才能運作。此事件展示了擴充功能權限控制的失效如何能產生跨越多個網絡應用程式的漏洞。
此事件重申了安全是共同的責任：用戶必須透過保持擴充功能更新和審查權限，將瀏覽器擴充功能視為可信軟件；而開發者應採用嚴格審計和最小權限實踐。雙方保持警惕對於維持安全的網絡生態系統至關重要。