https://github.com/grapheneos/pdfviewer
Simple Android PDF viewer based on pdf.js and content providers. The app doesn't require any permissions. The PDF stream is fed into the sandboxed WebView without giving it access to content or files. CSP is used to enforce that the JavaScript and styling properties within the WebView are entirely static.
https://github.com/grapheneos/pdfviewer
android grapheneos pdf pdf-viewer pdfjs security
Last synced: 2 months ago
JSON representation
Simple Android PDF viewer based on pdf.js and content providers. The app doesn't require any permissions. The PDF stream is fed into the sandboxed WebView without giving it access to content or files. CSP is used to enforce that the JavaScript and styling properties within the WebView are entirely static.
- Host: GitHub
- URL: https://github.com/grapheneos/pdfviewer
- Owner: GrapheneOS
- License: mit
- Created: 2017-01-16T21:20:40.000Z (over 8 years ago)
- Default Branch: main
- Last Pushed: 2025-04-13T02:57:49.000Z (3 months ago)
- Last Synced: 2025-04-14T03:11:52.346Z (3 months ago)
- Topics: android, grapheneos, pdf, pdf-viewer, pdfjs, security
- Language: Java
- Homepage: https://grapheneos.org/
- Size: 4.35 MB
- Stars: 715
- Watchers: 25
- Forks: 108
- Open Issues: 42
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
Simple Android PDF viewer based on pdf.js and content providers. The app
doesn't require any permissions. The PDF stream is fed into the sandboxed
WebView without giving it access to the network, files, content providers or
any other data.
Content-Security-Policy is used to enforce that the JavaScript and styling
properties within the WebView are entirely static content from the APK assets
along with blocking custom fonts since pdf.js handles rendering those itself.
It reuses the hardened Chromium rendering stack while only exposing a tiny
subset of the attack surface compared to actual web content. The PDF rendering
code itself is memory safe with dynamic code evaluation disabled, and even if
an attacker did gain code execution by exploiting the underlying web rendering
engine, they're within the Chromium renderer sandbox with less access than it
would have within the browser.