Yep, here’s an Acrobat Reader release from two days ago that fixes two arbitrary code execution vulnerabilities since the previous one two months ago: https://helpx.adobe.com/security/products/acrobat/apsb24-92....
I haven’t looked into browser-embedded PDF viewers enough to know how they compare to other software – they’re definitely much safer than Acrobat and still not completely safe (e.g. CVE-2023-1530 in Chrome wasn’t that long ago) – but I would expect them to be at least as safe as other browser functionality.
> Is that because PDFs natively have support for say executing code (i doubt)
They do (https://helpx.adobe.com/ca/acrobat/using/applying-actions-sc..., including “Run a JavaScript”, although that has to be enabled), but indeed that’s not the one fundamental issue; it’s usually just standard vulnerabilities of memory unsafety or terrible design (XML).
If I remember correctly Google bought a source code license from some Aussie company (?) for rendering PDFs in Chrome. That was like a decade ago though. I wonder what happened since. Probably lots.
https://web.archive.org/web/20140529210328/http://www.foxits...
> Founded in 2001, Foxit is a leading software provider of solutions for reading, editing, creating, organizing, and securing PDF documents. Headquartered in Fremont, CA, USA, Foxit has operations worldwide in China, Belgium, Japan, and Taiwan
seems like most of their presence was in china, and was domiciled in china, but they had sales "offices" in other countries and so they emphasized that part for better PR.
The author made this seem like such a fundamental issue. Is that because PDFs natively have support for say executing code (i doubt) or accessing the filesystem (i doubt), etc...