This might be paranoid, but if I go to a malicious website, can they tell what is inside a PDF on my desktop or what is inside my images on my hard drive?
I have a Chromebook and a Windows machine.
This might be paranoid, but if I go to a website that might not be 100% secure, can they tell what is inside my hard drive desktop's PDF or what is inside my images on my hard drive?
In general, unless you explicitly give them access to your hard drive—or documents on your hard drive—then no, an insecure website won’t be able to access anything.
That said (and emphasizing this to make it clear) there are indeed some incredibly rare—and esoteric—“zero-day” exploits that might be of concern in some edge cases. But in general, you—as an end user—need to go out of your way to allow a website to gain access to documents on your system. As long as your OS is patched and browsers are up to date you are safe. And even in cases where you are not patched and upgraded (and again emphasizing this to make it clear) the risk is still incredibly low.
The only concern with a website that “might not be 100% secure” (as the original question stated and I am assuming HTTPS versus plain HTTP) is that when you transmit data back and forth HTTPS is encrypted and HTTP is not encrypted.
The risk then is if you type something into the site via a form and such, if the site is plain HTTP then the data you are transmitting is just clear text that anyone with a packet sniffer has the potential to read. But that is a slim chance at best.
Like if you are on a known public Wi-Fi network then maybe someone is on that network with you and potentially capturing packets and thus could detect what you are typing.
An “insecure” website only really is a concern if you send data to them or you download an item from said website that will run code on your system.
By design browsers do not allow this but there is always the possibility of a bug that can be exploited to gain a higher level of access to your system. These bugs are fairly rare and always fixed very quickly so this is mainly an issue if your OS or browser is out of date. Both of these auto update now so just don't disable auto updates and you can be sure of a fairly good level of protection against malicious websites.
In the case of you using your computer to visit an untrusted website, you are using browser software on your computer to initiate web requests (the HTTP or HTTPS protocol) to receive data from the remote computer. In this simple model, the remote computer has absolutely no access to your computer, but... browsers have some features which complicate this picture.
Modern browsers have a feature which allows you to upload files from your computer. A website may include a form which makes use of this feature. This feature does not give the website a view into your computer. When your browser processes such a form, it presents you with a file selection control; your browser can see the files on your computer, and when you make a selection, your browser sends the contents of that file, and only that file to the remote system. The way this feature works leads some people to believe that the website can see files on your computer when it actually cannot.
TL;DR: An untrusted website cannot by itself see into your computer. But, a site can try to trick you into downloading and executing malicious software. Such software could potentially do anything on your computer. Your browser should not automatically download such software; at the very least, it should require your explicit acceptance. A malicious website could, however, try to trick you into giving such acceptance.
This is the reason why savy users have browser extensions that disable scripting at all times except for explicitly whitelisted websites which require them, and which thwart many other attacks such as cross-site request forgery and whatnot.
Exploits which allow remote code execution or allow accessing local files are published almost every month. Two recent examples for one well-known browser are 1 and 2. Examples for another well-known browser are 3 and 4.
(The above are random vulnerabilities which I picked with no obvious reason in mind, also they're meanwhile all fixed with the newest versions, to my knowledge.)
Browser attacks can not only allow a website to access files, they can in principle allow the website to take over your computer altogether, in the worst case. The issue is not limited to browsers, see WhatsApp video call vulnerability for a recent example. There was an exploit in a particular widely-deployed series of DSL routers a year or so ago which would allow a malicious website to take over your router even in presence of a password, if only you visited the website from your computer.
The level of stupidity necessary for an attack to be successful varies. For some attacks, the end user must be really, really stupid. For some attacks, the user must be only somewhat unaware for a split second. And some attacks will work even without the user doing anything stupid at all as long as some particular conditions are met.
In general a website can not access files on your hard drive or their meta information. Nevertheless you should be aware of a couple of things: