When an untrustworthy website offers some 'download this as PDF' functionality, be careful about opening it. This applies in situations where the PDF is generated by the website itself and not through the browser's print system. So most features which offer attack surfaces simply can't survive the conversion to a printout.īut keep in mind that there are known vulnerabilities in some versions of Adobe PDF reader (and other PDF readers) which can be exploited by especially crafted PDF files. Such active content can not be represented in print and not in a PDF either (PDF has some JavaScript support, but that uses a completely different API than javascript in a web browser, so most exploits won't be transferable). Most web-based exploits use javascript or browser plugins like Flash or Java. That means the web browser generates a printout, forwards it to the operating system's print system which then calls the driver which then takes that print output and turns it into a PDF.

A 'print to PDF' functionality is usually implemented as a virtual printer driver. However, even that is very unlikely to result in an infective PDF. It is in fact not unconceivable that there might be an exploit which only works when the website is printed out, because it targets a vulnerability in the browser's print system. It depends on how exactly the exploit on the website works.

Primo pdf malware