3

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might loose malicious code. On the other hand a local js might get access to local files...?

So: Is it a good idea to view attached pdf files in a browser?

(If it matters: I mostly care about Windows and a locally installed email client.)

3

It is generally considered safer to open PDFs in browsers, because they are better sandboxed than the other PDF readers installed on your computer. The sandbox should prevent the browser to access your local files (I'm simplifying a little). Anyway, if the PDF is malicious and targets (for example) Adobe Reader, nothing prevents Adobe Reader to access your local files, so in any case using a browser does not make you more vulnerable against this attack.

2
  • Yes, but what if the pdf is a LOCAL file? Does this increase the risk? Does the sandbox grant access to all local files?
    – leuk98743
    Jun 21 '19 at 16:30
  • @leuk98743 The sandbox does not grant more permissions to local files. Quite the opposite: usually, local files have less javascript capabilities granted by the browser.
    – A. Hersean
    Jun 24 '19 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.