Description

When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-23T08:17:10.623Z",
  "pubdate": "2026-09-23T08:17:10.623Z",
  "executiveSummary": "This vulnerability involves an improper authorization check within the JavaScript interface implementation of Foxit PDF Editor and Reader. The flaw stems from the application's failure to enforce mandatory attribute authorization checks as defined by the PDF specification. By failing to validate cross-document access boundaries, the JavaScript engine permits unauthorized interactions between isolated document contexts.\nThe primary impact of this vulnerability is unauthorized information disclosure. An attacker can craft a malicious PDF document that, when processed by the application, leverages the compromised JavaScript interface to exfiltrate sensitive data from other documents loaded within the same memory process. This vulnerability is particularly critical as it allows for the exfiltration of information to external domains or endpoints, bypassing the security model that should isolate document contents.\nExploitation requires the victim to open a maliciously crafted PDF file. Successful exploitation provides the attacker with the ability to bridge document security boundaries, potentially leading to the leakage of confidential information, metadata, or document content processed during the same application session. There is no requirement for elevated privileges on the host system, as the exploit is contained within the application's execution flow.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the JavaScript engine embedded within Foxit PDF Editor and Reader. The PDF specification mandates strict attribute authorization checks to maintain document-level security and cross-origin boundaries. In the affected versions, these validation routines are either omitted or incorrectly bypassed during the execution of JavaScript operations initiated by the PDF document's interactive features.\nThe exploitation flow begins when an attacker distributes a weaponized PDF file designed to invoke specific JavaScript APIs that interact with the Document Object Model (DOM) of the PDF reader. Because the internal authorization checks are not enforced, the JavaScript engine incorrectly assumes that the calling document has implicit permission to query attributes, properties, or sensitive data stored within other document contexts currently managed by the PDF application's runtime process.\nOnce the malicious PDF is rendered, the attacker's script executes within the context of the Foxit application's JavaScript interpreter. Using the flaw, the script can traverse the memory or internal document tree structures that reference other active documents. The attacker can then programmatically access sensitive information such as form data, cached document metadata, or visual content contained within non-malicious documents currently residing in the same memory space.\nFollowing the unauthorized extraction of this content, the attacker leverages the document's inherent ability to initiate network requests (such as through the XMLHttpRequest or similar transmission APIs permitted by the JavaScript engine) to send the exfiltrated data to an attacker-controlled remote server. The lack of proper origin validation means the application fails to distinguish between authorized and unauthorized document access requests, effectively enabling a cross-document data leakage vector.\nThis vulnerability is restricted to the context of the Foxit PDF Editor/Reader application process. It does not provide arbitrary code execution on the underlying host OS, but effectively breaks the document-based sandbox. The threat level is heightened by the ability to silently exfiltrate data while the user remains unaware of the malicious background operations occurring while the document is active in the viewer."
}