4 ms·

A pdf probably isn't going to be able to run JavaScript in your browser (the primary mechanism that this attack utilizes. Pastebin on the other hand... ;)

by joshka 10y ago

nmjohn 10y ago
No, but depending on what program you open it with it may be able to do far worse than execute javascript in a browser sandbox. [0][1] [0]: https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ [1]: https://thestack.com/security/2016/06/09/pdf-exploit-found-in-default-google-chrome-reader/ https://thestack.com/security/2016/06/09/pdf-exploit-found-i...
pests 10y ago
Except some major browsers like Chrome do their entire PDF rendering in JavaScript.
- JonathonW 10y ago
  Chrome's PDF renderer is a PPAPI plugin written in C++. Firefox is the one with the Javascript-based PDF renderer.
  - pjmlp 10y ago
    > Firefox is the one with the Javascript-based PDF renderer. And it shows, hence why I always disable it.
  - pests 10y ago
    Oops yes you are correct. My original point still applies though.
joshka 10y ago
In case the ;) did not make it obvious, this comment was meant to be taken as sarcasm.