PDFs are one of the most common file formats in the world, and most are perfectly safe. But the PDF specification is vast — it supports JavaScript, embedded files, form submission, and external links. That flexibility creates attack surface.
The main risks with PDFs are embedded JavaScript that exploits viewer vulnerabilities, phishing links disguised as legitimate URLs, and embedded files (a PDF can contain an executable as an attachment). Modern PDF readers like Chrome's built-in viewer and Adobe Reader run in sandboxed environments that mitigate most of these risks, but older or less common viewers may not.
To stay safe: open PDFs from trusted sources in a modern viewer. Chrome's built-in PDF viewer is one of the safest options because it disables JavaScript and runs in a strict sandbox. If a PDF asks you to "enable features" or "click to allow," that's a red flag — legitimate PDFs don't need special permissions.
For PDFs from unknown sources, inspect before opening. Check the file size (a 50 MB "invoice" is suspicious), verify the sender, and consider opening in a sandboxed environment. Google Drive's preview renders PDFs server-side, which isolates any malicious content from your device.
The format itself is not the risk — it's what's embedded inside. A PDF containing only text and images (which describes the vast majority of PDFs) is as safe as a JPG.