High severity8.6NVD Advisory· Published Aug 6, 2026

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

CVE-2026-16633

Description

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Pdf.jsllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hq66-cqwq-w95jghsaADVISORY
bugzilla.mozilla.org/show_bug.cgighsa
github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95jghsa

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000