Adobe: ‘Sandbox’ Will Stave Off Reader Attacks
Summary: Adobe said its next PDF Reader release will add sandbox technology that runs the application in a lower-privilege mode to block exploitation of previously unidentified security holes, with the feature on by default and initially limited to Windows. Adobe's Brad Arkin said Reader will reach the filesystem only through a separate broker process, and McAfee found roughly 28 percent of all known software exploits in the first quarter of 2010 targeted Reader, which F-Secure called the most-exploited application for Windows.
Key Takeaway: Researcher Didier Stevens noted the broker process could become the weakest link, since misleading it could still grant access, and the initial release will not sandbox read-only activities such as accessing content on the user's system.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026