News for hackers. Stuff that matters.

A comment on Embedded PDF viewer in Firefox 81 supports filling forms. Parent comment

Re:Embedded PDF viewer in Firefox 81 supports filling forms by snovv_crash on Tuesday September 22, 2020 @10:26AM (#24554690)
I find it extremely convenient. Also I know a lot of security issues in PDF viewers are effectively solved by running it in the browser's JS sandbox.
[ Parent | on HN ]
Re:Embedded PDF viewer in Firefox 81 supports filling forms by zelly on Saturday September 26, 2020 @10:54PM (#24603846)
Firefox's sandboxing incomplete or nonexistent (e.g. GPU process is not sandboxed on Linux).
[ Parent | on HN ]
Re:Embedded PDF viewer in Firefox 81 supports filling forms by Mediterraneo10 on Tuesday September 22, 2020 @10:34AM (#24554846)
You could also disable Firefox's built-in PDF viewer and instead use an external PDF viewer that doesn't even support Javascript.
[ Parent | on HN ]
Re:Embedded PDF viewer in Firefox 81 supports filling forms by snovv_crash on Tuesday September 22, 2020 @03:51PM (#24559017)
Native PDF clients have had lots of security holes. In this case having the client written in JS means we can repurpose the battle hardened JS sandbox to also contain PDF exploits.
[ Parent | on HN ]
Re:Embedded PDF viewer in Firefox 81 supports filling forms by nitrogen on Tuesday September 22, 2020 @10:46AM (#24555011)
Not all PDF vulnerabilities involve JS though.
[ Parent | on HN ]
Re:Embedded PDF viewer in Firefox 81 supports filling forms by detaro on Tuesday September 22, 2020 @10:46AM (#24555007)
You misunderstand the argument the parent comment makes. It's not about Javscript in PDFs.
[ Parent | on HN ]