I posted a question yesterday about PDF files in a browser that can be found here. There you can find more information about dealing with PDF documents in browser.

My question here is how each browser handles PDF files by default.

PDF files can cause security concerns because the have the capability to contain executable code.

What I have found is that some browsers today have their own PDF viewers. Some of those viewers open in a sandbox environment which at least seems to protect the end user. I have confirmed that both Chrome and Firefox open PDFs in a sandbox environment.

Question 1:

Do the following browsers also open PDFs in a sandbox (2020)?

  • Edge?
  • IE?
  • Safari?

Now these sandboxes sound pretty great if they can mitigate any security concerns with PDF files. My next series of questions regard the sandbox environments.

Question 2:

Is there any way a user might disable the protections a sandbox provides?

Question 3:

Are there still concerns when opening a PDF in a sandbox? i.e. could a user, or the code in the PDF break out of a sandbox.

Question 4:

Are there easy ways to verify a user is opening a PDF in the correct browser or with the correct settings before opening?

  • For number 3, I think all the processor vulnerabilities that are popping up make it pretty clear that processing ANY third-party input can be dangerous.
    – user
    Commented Feb 10, 2020 at 17:53
  • 1
    Opera uses sandbox since it's re-built on Chromium. Edge uses App containers. IE only supports PM sandboxing.
    – Overmind
    Commented Feb 11, 2020 at 8:26
  • @Overmind I am not familiar with App Containers or PM Sandboxing. Could you explain a bit about these and possibly if/how they can be used for safe PDF viewing? Commented Feb 11, 2020 at 15:00
  • 1
    Here MS Edge containerization is explained: computerworld.com/article/3124187/…
    – Overmind
    Commented Feb 12, 2020 at 6:51


You must log in to answer this question.

Browse other questions tagged .