PDF.js

PDF.js was originally created as an extension for Firefox and is included in Firefox since 2012 (version 15), and enabled by default since 2013 (version 19). It was added to Firefox for Android in 2023 (version 111).

The project was created to provide a way for viewing PDF documents natively in the web browser, which prevents potential security risks when opening PDF documents outside a browser, as the code for displaying the document is sandboxed in a browser. Its implementation uses the Canvas element from HTML5, which allows for fast rendering speeds.

PDF.js is also used in Thunderbird, ownCloud, Nextcloud, and is available as a browser extension for Google Chrome/Chromium, Pale Moon and SeaMonkey.

It can be integrated or embedded in a web or native application to enable PDF rendering and viewing, and allows advanced usages such as Server-side rendering.

Many web applications, including Dropbox, Slack, and LinkedIn Learning integrate PDF.js to enable previewing PDF documents.

According to a benchmark by Mozilla, PDF.js is performant for viewing most common PDF files, while it may have some issues with large or 'graphics-heavy' documents.

PDF.js supports most of the PDF specifications (including form support or XFA), but some features have not been implemented yet, which may impact rendering behavior depending on the features the document uses.

Several PDF/X or optional PDF features that are not supported in PDF.js include:

• ICC Color Profiles
• Spot colors
• Overprint simulation
• Transparency groups (knockout/isolation)
• High-fidelity printing

The PDF.js contributor community also notes that the browser behavior of PDF.js varies with browser support for PDF.js's required features. Performance and reliability will be the best on Chrome and Firefox, which are fully supported and subject to automated testing.

Because PDF.js parses untrusted documents inside the browser, it has been the subject of several disclosed vulnerabilities. In 2015, CVE-2015-2743 documented excessive privileges for internal workers in PDF.js, which was addressed in Firefox 39 and the ESR branches 31.8 and 38.1. A related Metasploit module exploited a privileged JavaScript injection in Firefox 35 and 36 through the PDF viewer.

In 2018, CVE-2018-5158 disclosed that PDF.js did not sufficiently sanitize PostScript calculator functions, allowing crafted PDF files to inject JavaScript with the privileges of the embedding page.

A more widely reported issue, CVE-2024-4367, was disclosed in May 2024 by researchers at Codean Labs. The vulnerability stems from a missing type check in PDF.js font handling, where a custom FontMatrix embedded in PDF metadata could be coerced into a string and reach eval, enabling arbitrary JavaScript execution within the PDF.js context. Mozilla addressed the issue in PDF.js 4.2.67, Firefox 126, Firefox ESR 115.11 and Thunderbird 115.11. National advisories were issued by the New York State Office of Information Technology Services and the Cyber Security Agency of Singapore.