There are kind of two questions here:

  1. Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"?
  2. If it is possible, does the pdf get access to the cookies for that domain the same as if it were a normal html file?

If this is only possible with certain specific pdf file readers and/or browsers, that would be great to know.


Yes, there were problems in this area with Adobe acrobat reader plugin, just google for "adobe acrobat plugin javascript attack cookie". I'm not sure if there are similar problems with the builtin JS viewers or if they are designed to live in a separate origin so that the same origin policy denies access. I don't think you even need to explicitly specifiy the Content-Disposition: inline.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.