WhatsApp Web users could be at risk of having their chats and personal information exposed through a security flaw in the Adobe Acrobat Chrome Extension.

Pakistan’s National Cyber Emergency Response Team (National CERT) has warned that the vulnerability could allow malicious websites to access information from an active WhatsApp Web session in Google Chrome.

The vulnerability, tracked as CVE-2026-48294 and covered by National CERT Advisory NCA-17.240826, affects Adobe Acrobat Chrome Extension versions 26.5.2.2 and earlier.

The issue is particularly concerning because an attacker does not need to install malware or steal a user’s WhatsApp password. Instead, the vulnerability can be abused through an already logged-in WhatsApp Web session in Chrome.

The attack begins when a user visits a specially designed or compromised website while using Google Chrome with an affected version of the Adobe Acrobat extension and an active WhatsApp Web session.

The vulnerability allows the website to access information from another website or service that it normally should not be able to access. This type of security problem is known as cross-origin information disclosure.

If successfully exploited, attackers could potentially gain access to sensitive WhatsApp Web information, including:

This could expose private communications and other personal information without requiring the victim to enter their WhatsApp credentials.

National CERT has identified several signs that could indicate an attempted or successful attack.

Users should be cautious if their browser suddenly redirects or refreshes pages without explanation, or if background tabs and windows open without their action.

Suspicious websites that ask users to click unusual buttons or open documents should also be treated with caution.

For WhatsApp Web specifically, users should watch for unusual activity, including chats or messages appearing to have been viewed without their knowledge.

Having Adobe Acrobat Chrome Extension version 26.5.2.2 or earlier installed is another potential indicator that a system could be exposed.

National CERT has advised users to immediately update the Adobe Acrobat Chrome Extension to the latest available version.

Users should also keep Google Chrome and other browser extensions updated. Security updates often fix vulnerabilities that could otherwise be used by attackers.

The advisory also recommends avoiding links from unknown or untrusted sources and being careful when visiting unfamiliar websites.

Users are encouraged to keep the number of browser extensions installed on Chrome to a minimum and only use extensions that are necessary.

Organizations have been advised to monitor browser activity, installed extension versions, and WhatsApp Web sessions for suspicious behavior.

They should investigate unusual activity quickly and advise affected users to review their linked WhatsApp devices. Users should log out of any devices or sessions they do not recognize.

In suspected compromise cases, organizations should preserve browser and network logs. These records can help security teams determine what happened and support further investigation.

National CERT has also asked organizations to report confirmed exploitation attempts and unusual activity.

Suspected incidents can be reported through the National CERT incident reporting portal, by email at [email protected] , or through the UAN at +92 519203412.

Confirmed compromises and indicators of exploitation should be escalated to National CERT Pakistan for further response and investigation.

Get the latest tech news, telecom insights, and product launches wherever you prefer.

Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.

Shares