What does HackerNews think of horrifying-pdf-experiments?
:syringe: Stuff which works in Chrome and maybe Acrobat and Foxit.
https://www.alchemistowl.org/pocorgtfo/
Yes. Not only is it possible but historically already an avenue of attack.
(Note, breakout game only works in Chrome's PDF reader)
> Scripts can supposedly do things like make arbitrary database connections, detect attached monitors, import external resources, and manipulate 3D objects.
That's an unprecedented level of power for what is supposedly a simple document format.
That being said, PDFs are only a threat when opened in a with support for these obscure APIs, such as Adobe's own readers. You (probably) will be fine opening untrusted PDFs in Chrome's PDF reader (PDFium) and Preview.
"Granted, most PDF readers (besides Adobe Reader) don't implement most of this stuff. But Chrome does implement JavaScript! If you open a PDF file like this one in Chrome, it will run the scripts."
https://github.com/osnr/horrifying-pdf-experiments
Doesn't work in Firefox for me. Try in Chrome if this is all you see on the first page.
Move your mouse down here!
also, README below...