Adobe Chrome extension flaw let sites access private WhatsApp chats
Summary
A vulnerability in the Adobe Acrobat Chrome extension allowed websites to access private WhatsApp chats without authentication. This flaw could potentially exfiltrate sensitive user data from WhatsApp Web sessions.
IFF Assessment
This vulnerability allows malicious websites to access sensitive user data, posing a direct threat to user privacy and security.
Severity
The vulnerability has a high attack complexity and high impact on confidentiality, as it allows unauthorized access to sensitive user data without any form of authentication.
Defender Context
This incident highlights the risks associated with browser extensions, even from reputable vendors, and the potential for them to become vectors for data exfiltration. Defenders should be aware of similar attack patterns targeting integrated services and encourage users to review and manage extension permissions carefully.