Why can't Apple just sandbox the damn thing? Run the renderer in a VM, call it a day.
Or just spend a few billion tokens rewriting the whole chain in a memory safe language. This nonsense is inexcusable in 2026
Or just spend a few billion tokens rewriting the whole chain in a memory safe language. This nonsense is inexcusable in 2026
Re security, there are many pdf viewers, so the rewrites exist, and some of them do not have the js execution engine and all that jazz that opens up all sorts of potential exploits.
PDFs may need to be further forwarded or edited on user's machine(s). Doing this in VM might save your device, only to pass the problem further down the road to a more vulnerable system.
The safe thing to do is to disarm the file - convert it in a blast proof VM. The conversion can and probably should be further tuned to explicitly disable some of the crazier, more moronic features of the format, sacrificing compatibility for safety. The same should be done with all other binary formats. It costs next to nothing, considering how crazy OP are today's phones. I wonder why it has not been done yet.
The other problem: I am not 100% sure if a clean rewrite would yield a safe viewer. As others have mentioned, PDFs can contain scripts. You'd always have to run them in VMs.
it's a feature. expect next exploit to also be pdf or image related.