Why PDFs Are the Most Dangerous File Format (And How to Handle Them Safely)

PDF has become the default format for sharing documents across organisations, industries, and borders. Contracts, invoices, tax documents, research papers, government forms — if it needs to be shared and look the same on every device, it gets sent as a PDF. This ubiquity is precisely what makes it the format of choice for attackers.

In 2024, 68% of malware delivered via documents used the PDF format — more than Word, Excel, and PowerPoint combined. That figure has remained consistently high for years, not because PDFs are inherently poorly designed, but because they are so widely trusted that recipients open them without the same caution they might apply to an executable file.

What makes a PDF file uniquely exploitable

Most people think of a PDF as a static document — a digital version of a piece of paper. In reality, the PDF specification is extremely complex. A PDF file can contain:

• JavaScript: The PDF specification includes a JavaScript engine. A malicious PDF can execute JavaScript when opened, triggering actions on the reader's system without any interaction from the user beyond opening the file.
• Embedded files and attachments: A PDF can contain other files embedded within it — executables, scripts, or additional documents. Some reader applications will extract and execute these automatically under certain conditions.
• Launch actions: PDFs can include actions triggered by events — opening the document, changing pages, or closing it. A launch action can attempt to run a system command or open an external URL.
• External links and URIs: PDFs can link to external resources. Clicking a link in a PDF opens it in a browser, which can be used for phishing or to redirect the user to a malicious site.
• Form data submission: Interactive PDF forms can submit data to external servers. A malicious form might exfiltrate data entered by the user, or data already present in the reader's session.

Common PDF attack patterns

Why reader software matters enormously

The risk profile of a PDF depends heavily on what software is used to open it. Adobe Acrobat Reader, Foxit, and other full-featured PDF readers implement much of the PDF specification, including JavaScript support, form submission, and launch actions. This is what attackers rely on.

Browser-based PDF rendering engines — the ones built into Chrome, Firefox, Safari, and Edge — implement a much smaller subset of the specification. They render visible content (text, images, vector graphics) but typically do not execute JavaScript, do not process launch actions, and do not extract embedded files. This makes opening a PDF in a browser's built-in viewer substantially safer than opening it in a full PDF reader application.

Red flags that suggest a malicious PDF

• Unexpected sender or context: An invoice from a company you have not dealt with, a delivery notification you were not expecting, or a legal document you did not request.
• Prompts to enable content or allow permissions: Legitimate PDFs do not need you to enable JavaScript or allow additional features to be read. Any such prompt is a strong warning sign.
• Urgency or pressure: "You must open the attached document immediately or your account will be suspended." Social engineering relies on overriding careful thinking with time pressure.
• Poor quality that requests you "verify" or "authenticate": A blurred or low-resolution document that instructs you to click something to see the full content is a classic technique for prompting harmful interaction.
• Links to external sites in the PDF: Hover over any links before clicking. The displayed text and the actual URL are often different in a malicious PDF.

How browser-based PDF tools reduce risk

When you use a browser-based tool like DocSuite's PDF Merger or PDF Splitter, your file is processed using JavaScript running in the browser's isolated sandbox — the same environment used to render web pages. The processing libraries (pdf-lib, PDF.js) work with the structural content of the PDF — pages, text layers, image data — without executing any JavaScript or launch actions embedded within the document.

This matters for two reasons. First, if you need to process a PDF that might be malicious — for example, splitting out pages from a document received from an unfamiliar source before forwarding it — doing so in a browser-based tool removes the risk of the embedded malicious code executing during processing. Second, because DocSuite's tools process files locally in your browser without uploading them to a server, your document's contents are not exposed to any third-party infrastructure.

Practical habits for safer PDF handling

1. Open PDFs from unknown sources in your browser first. Drag the file into a browser window or right-click and choose to open with the browser. If the content renders and there are no unexpected prompts, it is likely safe.
2. Keep your PDF reader updated. Most exploitation of PDF readers targets known vulnerabilities in older versions. If you use a desktop reader, enable automatic updates.
3. Disable JavaScript in your PDF reader. In Adobe Acrobat, this option is under Preferences → JavaScript. For most document reading tasks, you do not need PDF JavaScript enabled.
4. Do not click links in unexpected PDFs. If a PDF contains a link you did not expect, navigate to the site directly by typing the URL rather than clicking the link in the document.
5. Be especially cautious with email attachments. Email remains the primary delivery mechanism for malicious PDFs. If the email was unexpected, the sender is unfamiliar, or the context does not make sense, treat the attachment as suspicious.