# Fickle PDFs: exploiting browser rendering discrepancies

DevFeed: [Fickle PDFs: exploiting browser rendering discrepancies](<https://devfeed.tech/articles/fickle-pdfs-exploiting-browser-rendering-discrepancies-7677.md>)

Original publisher: [Read original article](<https://portswigger.net/research/fickle-pdfs-exploiting-browser-rendering-discrepancies>)

Author: Zakhar Fedotkin

Published: 2024-07-09T12:51:22Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [pdf](<https://devfeed.tech/topics/pdf.md>), [browsers](<https://devfeed.tech/topics/browsers.md>), [Google Chrome](<https://devfeed.tech/topics/google-chrome.md>), [Firefox](<https://devfeed.tech/topics/firefox.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [apache](<https://devfeed.tech/tags/apache.md>), [article](<https://devfeed.tech/tags/article.md>), [browser](<https://devfeed.tech/tags/browser.md>), [code](<https://devfeed.tech/tags/code.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [google-chrome](<https://devfeed.tech/tags/google-chrome.md>), [java](<https://devfeed.tech/tags/java.md>), [pdf](<https://devfeed.tech/tags/pdf.md>), [research](<https://devfeed.tech/tags/research.md>)

## AI overview

The article explains how hybrid PDFs can exploit rendering discrepancies across browsers and PDF viewers. It demonstrates how widget annotations and interactive form fields can cause the same invoice to display different prices, and presents a proof of concept using the org.apache.pdfbox Java library.

## Source excerpt

Imagine the CEO of a random company receives an email containing a PDF invoice file. In Safari and MacOS Preview, the total price displayed is GBP 399. After approval, the invoice is sent to the accounti