¥app.alert(1) is the new alert(1): PDFs as a vector to inject JavaScript in web apps - Luigi Gubello
NDC Conferences · 51:44
In-browser PDF viewers have become a practical XSS (and sometimes RCE) vector because popular SDKs parse untrusted PDF objects in JavaScript, and Adobe-style embedded JS is hard to sandbox safely next to the DOM. The...