Web Hack List

Collected research

Fickle PDFs: exploiting browser rendering discrepancies

A PDF form text field carries both a value and a widget annotation with its own appearance stream. Chrome's PDFium, Firefox's PDF.js and Google Drive draw the annotation, while Safari and macOS Preview ignore it and draw the field value, and ChatGPT reads only the value. One invoice built with Apache PDFBox therefore shows a 399 total to the approver and 999 to whoever pays it, and an annotation can repaint the whole page.

Record

Researcher
Zakhar Fedotkin
Published by
PortSwigger Research
Date
Topic
Browser

In the archive

Related sources

Tags

This page is the archive's own catalogue record. The research is the work of Zakhar Fedotkin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .