Fickle PDFs: exploiting browser rendering discrepancies

Summary: PortSwigger researcher Zak Fedotkin published research on creating hybrid PDFs that abuse widget annotations to produce different displayed content across PDF renderers, using a proof-of-concept invoice showing £399 in Safari and macOS Preview but £999 in Google Chrome, Google Drive preview, and Firefox. Chrome's PDFium updates the displayed text from the annotation value to the form field's default value on user interaction, Firefox and Google Drive preview prioritize the widget annotation, and Safari's engine bypasses the annotation and shows only the default value.
Why it matters: A single invoice file can show one total to the approver and a different total to the accounting department that pays it, and the article notes annotations can theoretically overwrite the entire page.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026