Adobe Acrobat WhatsApp Flaw “HermeticReader”

Adobe Acrobat's Hermes-based WhatsApp integration contained a universal cross-site scripting flaw dubbed "HermeticReader" (CVE-2026-48294, CVSS 7.4) that could let a malicious webpage bypass browser boundaries and exfiltrate WhatsApp Web session contents; the issue affected versions up to 26.5.2.2 across an estimated 329 million browsers, was patched in version 26.5.2.3 with no observed active exploitation, and organizations are advised to verify extension versions, update or remove unnecessary extensions, and review managed browser update policies.