Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

Possible Duplicate:
Are .docx or .pdf files potentially dangerous?

Google Chrome just came out with an update (new version) and now it tells me that PDF downloads may harm my computer.

What can the PDF file do that is dangerous?

share|improve this question
zdnet.com.au/… an old issue though – khachik Dec 10 '10 at 14:21
I'm quite sure it doesn't suddenly tell you this. However, it's probably warning you about some specific websites? – Arjan Dec 10 '10 at 15:57
Related: Are PDF files potentially dangerous? – Sathya♦ Dec 10 '10 at 16:18
Arjan: Google Chrome just came out with an update (new version) and now it tells me this. I expect it is not site specific. – George Bailey Dec 10 '10 at 16:47
Okay, so then it's not "all of a sudden" at all! – Arjan Dec 11 '10 at 12:45
show 2 more comments

migrated from stackoverflow.com Dec 10 '10 at 14:24

marked as duplicate by Arjan, ChrisF, random♦ Dec 12 '10 at 23:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers

up vote 4 down vote

aside from acrobat reader being one of the most favored attack vectors, it can have embedded js, embedded executables, embedded video, has had many codec problems that allowed buffer overflows, currently opts out of security features offered by host OSes(DEP and/or ASLR), and lets individuals hit flash without going through a browser(which means you think you're downloading a pdf and you get flash active content, a bad practice)

share|improve this answer
note: there is talk that it will soon take part in host OS security features – Call me V Dec 10 '10 at 14:29
up vote 0 down vote

They've always been potentially harmful, and in the past few months they've been very harmful. Part of the new notification may be that Google chrome now has ways of protecting you by showing the PDF inline with chrome, which has some isolation protection (called sandboxing). Maybe now that they can do something about it, they'll tell you.

PDF files are complex, which means you need to write complex code to show them. If code has bugs, it may be used to take over a computer. Complex code has much more chance to have these bugs. Acrobat is very complex and has these bugs. Acrobat Reader also allows Javascript, a programming language. If you don't isolate the language well, it can do bad things. Acrobat has had problems with the isolation recently.

share|improve this answer
up vote 0 down vote

See Symmantec's The Rise of PDF Malware, by Karthik Selvaraj and Nino Fred Gutierrez.

Surprise, it's a PDF file!

We have seen an ever increasing use of PDFs for malicious purposes over the past two years. [...] In this whitepaper, we discuss the current PDF threat landscape, some current vulnerabilities being exploited in PDF documents, and various methods used by the malware authors.

http://www.symantec.com/connect/blogs/rise-pdf-malware

The Chrome change went in with Revision 63158; if you look at the diff, you'll see quite a few other file types, which you might not use as often as PDFs, were also added.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.