Collected research
Fickle PDFs: exploiting browser rendering discrepancies
A PDF form text field carries both a value and a widget annotation with its own appearance stream. Chrome's PDFium, Firefox's PDF.js and Google Drive draw the annotation, while Safari and macOS Preview ignore it and draw the field value, and ChatGPT reads only the value. One invoice built with Apache PDFBox therefore shows a 399 total to the approver and 999 to whoever pays it, and an annotation can repaint the whole page.
Record
- Researcher
- Zakhar Fedotkin
- Published by
- PortSwigger Research
- Date
- Topic
- Browser
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Zakhar Fedotkin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .