¥app.alert(1) is the new alert(1): PDFs as a vector to inject JavaScript in web apps

on YouTube ↗52m

" summary

Shows concrete exploit paths: app.alert(1) is often benign but attackers chain real issues in libraries like PDF.js and Apryse Webviewer to run JS. Demonstrates two unsanitized array entry points (font matrix/glyph) leading to XSS (CVE-2018-5158, CVE-2024-4367) and a sandbox bypass that deletes blocked globals to regain DOM access, plus an annotation default-value -> unsafeInnerHTML flaw used against Dropbox. Notes scale: PDF.js downloads ~3.5M/week and multiple CVEs in 2024, and which mitigations actually work.

AI-written summary · about

" chapters (13)

1. 0:00PDF as modern web attack vector
2. 1:09PDF JavaScript sandbox bypass risks
3. 2:20History of PDF and JavaScript
4. 7:26First XSS in PDF.js (2018)
5. 10:58Second XSS in PDF.js (2024)
6. 15:59XSS in Apprise PDF SDK
7. 26:47PDF.js more secure than Apprise SDK
8. 33:24Bypassing Apprise sandbox with annotations
9. 37:01PDF.js in Electron apps and RCE in Slack
10. 41:00False positives in PDF XSS reports
11. 45:18Bug bounty hunting recommendations
12. 47:21Mitigating PDF-based XSS
13. 50:14Q&A

" related talks

• 33mPDF - Mess With The WebAlex Infuhr · OWASP AppSec Research (AppSecEU) 2015
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 01h 02mPrompt-Jacking: The Rise of a New Supply Chain RiskKasimir Schulz, Kenneth Yeung · NDC Toronto 2026
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 50mModern WebApp VulnerabilitiesErlend Oftedal · Øredev 2019
• 45mPrompt-Jacking: The Rise of a New Supply Chain RiskKasimir Schulz, Kenneth Yeung · NDC AI 2025