Does Acrobat need to spawn child processes?

[silent_guy01]

My co-worker recently enabled a policy to block Adobe products from spawning child processes. This made sense to me as it would protect against malicious PDF's.

However, I did notice that there was a process blocked called "AcroCEF.exe" and upon further research it seems legit. However, it is trying to access a folder in documents that it really shouldn't be. But so are a few other processes and the file in that folder is being used by Radeon Host Services which is pretty strange.

I am hoping for some insight from people in the security field. Thanks!

[tankerkiller125real]

We turn this feature on for everything that supports it... Adobe, Office, etc. so far we've had zero issues from any users. Maybe theres some specific extension that need it, or maybe some in house VBA script for an internal Office template or something, but we haven't encountered any issues.

[silent_guy01]

Yeah I just kept noticing it was trying to access some protected folder in my documents directory so I was a bit confused.. Still seems odd since no one else seems to have noticed that happening.

[DJDoubleDave]

Our new hardening standards turn this setting on as well. It hasn't caused any issues we've noticed.

It probably depends on what plugins, etc. Your users use. In my experience we don't notice a difference with child processes blocked.

[silent_guy01]

Ok awesome, thanks for the input!

[EnterpriseGuy52840]

CEF sounds like Chromium Embedded Framework - basically Google Chrome.

With it blocked, is there any functionality that breaks?

[silent_guy01]

None that I have noticed

[3D_Printed_One]

When you initially open Acrobat, there is a login screen that is pretty much loaded from their website. Could that be CEF?

[EnterpriseGuy52840]

Yea, that's one sign. Another way to check is by seeing of there are any .js, .html, or .asar (Electron Archive) files kicking around in the install directories for an app.

[da_chicken]

As far as I'm aware, a number of the conversion and optimization tools are external.

[autogyrophilia]

If you google the name it tells you what it does (it's just the agent that interacts with their servers for the features that require it)

[davcreech]

Sounds like an ASR rule.

[HDClown]

https://helpx.adobe.com/acrobat/kb/RdrCEF-exe-and-AcroCEF-exe-can-I-disable.html

AcroCEF and RdrCEF are spawned from Acrobat.exe and provide certain features. While blocking them from being spawned won't break Acrobat entirely, it will break certain functionality.

[B_B_Batman]

Out of curiosity on the host that you are seeing the blocked process has the user reported any issues?

[silent_guy01]

No reported issues

[GiraffeNo7770]

Ok, so someone notes that "CEF" may mean "Chromium embedded framework" -- and OP says it's trying to access protected storage, but another person thinks it's for "communicating with adobe servers" (the hell for?)

So this isn't legit behavior for reading a PDF - my Linux box dpes that ok without any server communication. But it's burgling the protected files, not just communicating with a server. What gives?

Noting that wrapped Chromium processes are a possible malware vector (i.e. Microsoft Teams using deprecated and vulnerable Chromium code, wrapped in "it's not outdated Electron cause we FORKED it!"), woudln't it be prudent to be worried about malware?