I recently started using Firefox for Android and saw I can download pages as PDF and near every image or video for any site and I'm using that quite a lot so what is the risk of downloading such things from websites?

Lets say I download an image with embedded malicious code? Will malicious JavaScript or others be downloaded when I save an page as PDF? I only open my PDFs via Google Drive built in support if that matters.

  • Copyright issues... not a security risk in itself, but still worth considering. When you scrape a site, you are leaving yourself open to all of the vulnerabilities in that site.
    – KingJohnno
    Jan 23, 2015 at 15:04
  • I'm not downloading anything to use commercially or anything like that just for personal use.So copyright is not an issue
    – Freedo
    Feb 6, 2015 at 21:57

3 Answers 3


In general, no: you should not be excessively worried about such an attack. To exploit this would require a bad guy to figure out a way to embed malicious code in their images, videos (or whatever) that activates after that image (or whatever) has been converted to a PDF and is then viewed.

Bear in mind that the thing doing the to-PDF conversion in this scenario is your phone: you would want to be much less trusting of a PDF generated by a third party.


There used to be a danger in downloading and running content locally in Internet Explorer 3 and earlier. Microsoft introduced Mark of the Web in IE4 that would make a locally ran website run in the security zone context from which it had been downloaded rather than in the context of the local machine (think file:/// rather than

JavaScript running locally would normally have full permissions to the file system under the context of the current user. However modern browsers now restrict this and Internet Explorer will prompt before allowing ActiveX content to run locally.

If you are printing the current page to PDF you should be fine. There is no extra danger of things executing as the browser is only printing what it already has rendered.

Regarding other files, this depends on how you are doing it and the maliciousness of that particular site you are downloading from. If you are using some sort of spidering tool a malicious page might reference a link to a trojan in the form <a href="page/trojan.exe">Click Me!</a>. Although these links are now treaty more securely so you shouldn't be able to execute them without a prompt, you would still be downloading the executable to your machine. Try to be as careful as possible and review whether the particular method you are using to download would be vulnerable to this.


It depends on what site you visit. Not everything you're downloading is malicious or vice versa.

www.netcraft.com provides service for blocking URL against known malware/phishing sites you can add this toolbar to your browser. This mitigates risk to a extend.


Hope this helps.

  • Between you and me i heard someone might want to download videos or images from porn sites, or just like to save pages as pdf for later use without internet access, and i don't think that using the extension from a know data-mining company is good at all, they are probably using you to track the sites you visit
    – Freedo
    Feb 6, 2015 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .