I get eBooks and literature from a variety of places. Mostly legal places, like Amazon - but sometimes from other random places.

PDFs are more popular and come with advanced capabilities, like JScript, that should be disabled in the name of security.

Are there any known security issues for other e-Formats - like ePubs - or are there steps that should be taken to protect ones self? Mainly for when getting books from different sources and being used on Windows/Android/Kindle/etc?

  • 1
    Interesting (and long) read here: baldurbjarnason.com/notes/epub-javascript-security
    – Jason Down
    Commented Feb 14, 2014 at 18:15
  • This link describes the scripting available in Epub 3.1 but I haven't found a reader yet that supports scripting. I suspect authors don't want to put in any scripting just in case something bad happens and the author gets blamed.
    – Bulrush
    Commented Apr 18, 2016 at 12:56

1 Answer 1


Most reading systems for epubs do not include JavaScript support at this time, so you're fairly safe. For those that do, the IDPF (International Digital Publishing Forum; they're the folks who make the epub standard) has a section on security in the epub 3.0 spec. It pretty much lays the onus on the reading system developers to disable various avenues of attack. One thing of note is that all their points are phrased as "reading systems should" where "should" means:

that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.

So their security concerns may or may not be addressed by individual reading systems. It's a good bet that the major ones will play ball, though--particularly as most of them have someone in the IDPF.

As far as downloading stuff from random places on the web--well, run a virus scan on anything you get and you'll probably be okay, but that's always riskier than going through "official" channels.

  • 1
    To add to Tom's answer: Apple probably disabled localStorage and, more prominently, network access from JS code in iBooks, for security reasons. Commented Feb 14, 2014 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.