On Linux systems the printing functionality of Chrome (printing of websites or PDF documents) generates PDF documents which are sent to the print server (e.g., CUPS). Are there any security mechanisms built into Chrome which ensure that these PDF files do not contain any potentially harmful content like JavaScript?


Given that PDF uses postscript for its page layout while web pages use HTML and CSS, it would be exceedingly difficult to write javascript which would perform any useful function in both media. That is not to say that it might be possible to write javascript targeting the PDF conversion and deliver it via a web page, however it is good reason to exclude the javascript from the PDF output before considering the security angle.

Certainly in the case of generating hard copy, the PDF is converted to a printable format by ghostscript - which has no Javascript engine. Hence the only viable attack vector is print-to-file.

It wouldn't be hard to test whether javascript persists across the initial PDF conversion using Didier Steven's tools.

| improve this answer | |
  • I think you might mislead readers telling PDF uses postscript for its page layout . As en.wikipedia.org/wiki/Portable_Document_Format#PostScript states PDF is not using postscript but "[it] is largely based on PostScript but simplified to remove flow control features" . This matters here because such features make postscript a turing complete object. PDF adopt only a subset of postscript that is not turing complete, reducing risks. – humanityANDpeace Aug 12 '16 at 16:17

As I'm aware Google Chrome just provides "security" when you download a file.

So answering your question, unless you actually download the file I don't think that Google will check for virus in that specific file.

But Google does offer security in a way that prevents scripts that can send information to the server, so it may just do that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.