And each could contain JavaScript code written by literally anyone. But if you perform a search for PDF files on, you'll be presented with literally billions of PDF files, each of which could be written by any random person. Assuming a non-compromised connection, any JavaScript code running on that domain would be written by Google developers (for better or worse). Although, hopefully, any code executed from a PDF file will have at least the same security in place as JavaScript run from a website, the source and control of PDF content being loaded is often very different than a website.įor example, let's take (as Henny Youngman would add, 'please'). On the surface, this sounds quite concerning from a security standpoint. If you find any bug with this feature, please file an issue on the PDF.js repository. We keep on working on improving our PDF forms support and now support JavaScript embedded in PDF files (some PDF forms use JavaScript for validation and other interactive features). Many colleagues have done the same.Īccording to the pre-release notes for Firefox 88, which is being pushed to the public any hour now: Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another scripting language, or even macros.Īs such, since the first days that JavaScript could be embedded into PDF files, I have disabled JavaScript support within every PDF reader and editor I have used.

Fire fox pdf reader