5 ms·
In general that's not true. Folks save web pages to their desktop or downloads folder all the time, when opening a saved Wikipedia .html file people don't assum
by esprehn 4y ago
In general that's not true. Folks save web pages to their desktop or downloads folder all the time, when opening a saved Wikipedia .html file people don't assume it can then read every other file on your desktop. Worse would be if you saved it to your Documents or ~.
Web pages are assumed to be "safe" by users, like a pdf or a png.
- Aeolun 4y agoSafe like a PDF is probably a good equivalent :)
- deleted 4y ago[deleted]
- egberts1 4y agoPlease consult CVE for numerous citations on PDF file. Furthermore, PDF also runs JavaScript, their Kind of JavaScript, depending on where you downloaded it from.
- saurik 4y agoAn exploit in the renderer isn't the same as supported dangerous behavior.
- tgsovlerkhgsel 4y agohttps://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... is the only case in the past few years that I'm aware of where a PDF vulnerability was actually exploited before it was widely patched, and that was a highly targeted attack. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reader https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reade... shows 4 potentially exploitable vulnerabilities + 1 that lets the attacker check if a file exists. I couldn't find any semi-recent ones affecting Firefox' PDF.js.