CVE-2009-1600: Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit elemen...

Security readout for executives and security teams

This old Safari-related issue concerns untrusted PDFs behaving like active web content. In a specific upload-and-inline-viewing scenario, a PDF could trigger browser DOM access that Adobe Acrobat JavaScript restrictions were meant to prevent. The bundle does not identify affected versions, a patch, or real-world exploitation. Exposure appears limited to sites that allow untrusted PDF uploads, render them inline, and serve them in a context sharing document.domain with sensitive application pages. Specific Safari, Acrobat, and platform versions are not provided. Low immediate urgency unless the organization still hosts untrusted PDFs inline on shared application domains or supports legacy Safari/Acrobat environments. Prioritize validation in upload-heavy portals and document-sharing services. Mitigation focus: Treat uploaded PDFs as active content, not inert documents.; Isolate untrusted PDFs on a separate origin or domain.; Avoid sharing document.domain with user-uploaded content..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.