Portable Data exFiltration: XSS for PDFs

Gareth Heyes shows how a single injected hyperlink can compromise PDFs: injecting PDF code to execute JavaScript, exfiltrate contents in Acrobat and PDFium, and trigger SSRF on server-side renders.