Secure PDF Viewer

GrapheneOS

About this app

Simple Android PDF viewer based on pdf.js and content providers. The app doesn't require any permissions. The PDF stream is fed into the sandboxed WebView without giving it access to the network, files, content providers or any other data.

Content-Security-Policy is used to enforce that the JavaScript and styling properties within the WebView are entirely static content from the APK assets along with blocking custom fonts since pdf.js handles rendering those itself.

It reuses the hardened Chromium rendering stack while only exposing a tiny subset of the attack surface compared to actual web content. The PDF rendering code itself is memory safe with dynamic code evaluation disabled, and even if an attacker did gain code execution by exploiting the underlying web rendering engine, they're within the Chromium renderer sandbox with less access than it would have within the browser.

Ratings and reviews

I like to know that this is a secure way to view PDFs, however there are some areas where user experience suffers. The maximum you can zoom into a document is pretty limited, and it seems to depend on your device's display size. Jumping to a page with the carasol may be fine for shorter documents, but for 100+ page documents, it's just not efficient. Finally, I wish there was an option for the app to automatically save your last position on a document to jump back into the next time it's opened.

Opens and loads easy but the zoom of the psf appears to be locked to the display size, so on most of my pdfs I had to pan and move the viewing area to read a whole line of text. I had to read a pdf like a type writer head moving across the page. Not good for ebooks.

The application is simple, but it needs development and attention to the interface and user experience. standards are clear, such as warning the user if the file contains malicious code. Thank you. Thanks for the reply. I think I did not find the expression. From my experience with the program, I suggest that before opening the file, there should be a warning message if the file contains malicious code. Hackers are constantly developing malicious

What’s new

Notable changes in version 31:

• minor fixes for edge-to-edge support
• fix issue causing the text layer used for text selection to not rotate when the PDF is rotated within the app
• enable hardware memory tagging for use outside of GrapheneOS in the narrow cases where it's available
• update pdf.js to 5.4.149
• update other npm dependencies
• update AndroidX libraries
• update Android SDK and toolchain

See https://github.com/GrapheneOS/PdfViewer/releases/tag/31 for the full release notes.