PDF.js
ScreenshotPDF js Screenshot in Firefox 100.png
AuthorAndreas Gal
DeveloperMozilla
Released2 July 2011[1]
Programming languageJavaScript, CSS, HTML
Size3.94 MB[1]
PlatformJavaScript engine, web browser
GenrePDF viewer
LicenseApache License 2.0[2]
Websitemozilla.github.io/pdf.js

PDF.js is a JavaScript library that renders Portable Document Format (PDF) files using the web standards-compliant HTML5 Canvas. The project is led by the Mozilla Corporation after Andreas Gal launched it (initially as an experiment) in 2011.

History and application

PDF.js was originally created as an extension for Firefox[3] and is included in Firefox since 2012 (version 15),[4][5] and enabled by default since 2013 (version 19).[6][7] It was added to Firefox for Android in 2023 (version 111).[8][9]

The project was created to provide a way for viewing PDF documents natively in the web browser, which prevents potential security risks when opening PDF documents outside a browser, as the code for displaying the document is sandboxed in a browser.[10] Its implementation uses the Canvas element from HTML5, which allows for fast rendering speeds.[10]

PDF.js is also used in Thunderbird,[11] ownCloud,[12] Nextcloud,[13][14] and is available as a browser extension for Google Chrome/Chromium,[15] Pale Moon[16][17] and SeaMonkey.[17][18]

It can be integrated or embedded in a web or native application to enable PDF rendering and viewing, and allows advanced usages such as Server-side rendering.

Many web applications, including Dropbox,[19] Slack,[20] and LinkedIn Learning[21] integrate PDF.js to enable previewing PDF documents.

Behavior

According to a benchmark by Mozilla, PDF.js is performant for viewing most common PDF files, while it may have some issues with large or 'graphics-heavy' documents.[22]

PDF.js supports most of the PDF specifications (including form support or XFA[23]), but some features have not been implemented yet, which may impact rendering behavior depending on the features the document uses.[24]

Several PDF/X or optional PDF features that are not supported in PDF.js include:

The PDF.js contributor community also notes that the browser behavior of PDF.js varies with browser support for PDF.js's required features.[28] Performance and reliability will be the best on Chrome and Firefox, which are fully supported and subject to automated testing.

Security

Because PDF.js parses untrusted documents inside the browser, it has been the subject of several disclosed vulnerabilities. In 2015, CVE-2015-2743 documented excessive privileges for internal workers in PDF.js, which was addressed in Firefox 39 and the ESR branches 31.8 and 38.1.[29][30] A related Metasploit module exploited a privileged JavaScript injection in Firefox 35 and 36 through the PDF viewer.[31]

In 2018, CVE-2018-5158 disclosed that PDF.js did not sufficiently sanitize PostScript calculator functions, allowing crafted PDF files to inject JavaScript with the privileges of the embedding page.[32][33][34]

A more widely reported issue, CVE-2024-4367, was disclosed in May 2024 by researchers at Codean Labs.[35] The vulnerability stems from a missing type check in PDF.js font handling, where a custom FontMatrix embedded in PDF metadata could be coerced into a string and reach eval, enabling arbitrary JavaScript execution within the PDF.js context.[36] Mozilla addressed the issue in PDF.js 4.2.67, Firefox 126, Firefox ESR 115.11 and Thunderbird 115.11.[37] National advisories were issued by the New York State Office of Information Technology Services and the Cyber Security Agency of Singapore.[38][39]

See also

References

  1. ^ "Releases · mozilla/pdf.js". GitHub. Retrieved 12 March 2021.
  2. ^ "pdf.js/LICENSE at master · mozilla/pdf.js". GitHub. 17 February 2022.
  3. ^ "PDF Viewer(discontinued)". addons.mozilla.org. Archived 5 December 2015 at the Wayback Machine. Retrieved 2015-12-02.
  4. ^ Parfeni, Lucian (2012-04-30). "PDF.JS and Download Manager Panel Pushed to Firefox 15". Softpedia. SoftNews. Retrieved 15 May 2026.
  5. ^ Blagoveschenskiy, Anton (2012-08-29). "Вышла новая версия браузера Firefox 15" [New version 15 of the Firefox browser released] (in Russian). Rossiyskaya Gazeta. Retrieved 2012-09-09.
  6. ^ "Bug 773397 – Disable pdf.js prior to FF15 beta 5". bugzilla.mozilla.org. Retrieved 15 May 2026.
  7. ^ "Firefox 19.0 Release Notes". mozilla.org. Retrieved 30 April 2013.
  8. ^ "Firefox for Android 111.0, See All New Features, Updates and Fixes". www.mozilla.org. Retrieved 19 April 2024.
  9. ^ Adhikari, Sumit (2023-03-16). "Firefox 111 for Android brings Total Cookie Protection & PDF viewer". Android Headlines. Retrieved 2026-05-15.
  10. ^ Shankland, Stephen (2011-06-24). "Mozilla eyes hassle-free PDFs on the Web". CNET. Retrieved 2022-05-24.
  11. ^ "810815 - Integrate pdf.js to Thunderbird". bugzilla.mozilla.org. Retrieved 2022-01-28.
  12. ^ "owncloud/files_pdfviewer", ownCloud, 2020-02-08, retrieved 2020-03-28
  13. ^ "nextcloud/files_pdfviewer", Nextcloud, 2020-03-18, retrieved 2020-03-28
  14. ^ "PDF viewer - Apps - App Store - Nextcloud". apps.nextcloud.com. Retrieved 2020-03-28.
  15. ^ "PDF Viewer". Chrome Web Store. Retrieved 15 May 2026.
  16. ^ "Add-ons - Moon PDF Viewer". Pale Moon - Add-ons. Archived January 3, 2020 at the Wayback Machine. Retrieved May 4, 2021.
  17. ^ "IsaacSchemm/pdf.js-seamonkey: SeaMonkey fork of pdf.js". GitHub. Archived December 6, 2020 at the Wayback Machine. Retrieved May 4, 2021.
  18. ^ "PDF Viewer for SeaMonkey". Add-ons for SeaMonkey. 25 April 2020. Archived from the original on 13 January 2020. Retrieved 13 January 2020.
  19. ^ Lauraharrisneal. "Annotations on Document Previews". dropbox.tech. Retrieved 2021-08-05.
  20. ^ "What matters to you, matters to us. - Slack Engineering". Slack Engineering. 2016-11-16. Retrieved 2021-08-05.
  21. ^ Rawat, Anurag (24 April 2019). "Under the hood: Learning with documents". engineering.linkedin.com. Retrieved 2021-08-05.
  22. ^ Bochenek, Thorben (8 May 2014). "How fast is PDF.js? – Mozilla Hacks - the Web developer blog". Mozilla. Retrieved 15 May 2026.
  23. ^ "1706133 - (pdf-xfa) [meta] XFA support". bugzilla.mozilla.org. Retrieved 2022-01-28.
  24. ^ "Guide to Evaluating PDF.js Rendering". PDFTron. Retrieved 2021-08-05.
  25. ^ "ICC profiles support for images · Issue #2856 · mozilla/pdf.js". GitHub. Retrieved 2022-05-24.
  26. ^ "Overprint Support · Issue #7360 · mozilla/pdf.js". GitHub. Retrieved 2022-05-24.
  27. ^ "Issue about knockout groups. · Issue #3136 · mozilla/pdf.js". GitHub. Retrieved 2022-05-24.
  28. ^ "Frequently Asked Questions · mozilla/pdf.js Wiki". GitHub. Retrieved 2021-08-05.
  29. ^ "CVE-2015-2743". CVE Details. Archived 4 June 2016 at the Wayback Machine. Retrieved 15 May 2026.
  30. ^ "cve-2015-2743". nvd.nist.gov. Retrieved 2026-05-15.
  31. ^ "Mozilla Firefox 'pdf.js' Privileged JavaScript Injection (Metasploit)". Exploit Database. Offensive Security. 2015. EDB-ID:37958. Archived 12 September 2015 at the Wayback Machine. Retrieved 15 May 2026.
  32. ^ "CVE-2018-5158". GitHub Advisory Database. Retrieved 2026-05-15.
  33. ^ "CVE-2018-5158". nvd.nist.gov. Retrieved 2026-05-15.
  34. ^ "CVE-2018-5158". CVE Details. Archived 18 August 2019 at the Wayback Machine. Retrieved 15 May 2026.
  35. ^ "cve-2024-4367". nvd.nist.gov. Retrieved 2026-05-15.
  36. ^ Suijten, Thomas (20 May 2024). "CVE-2024-4367: Arbitrary JavaScript execution in PDF.js". Codean Labs. Archived 20 June 2024 at the Wayback Machine. Retrieved 15 May 2026.
  37. ^ "Security Vulnerabilities fixed in Firefox 126 — Mozilla Foundation Security Advisory 2024-21". Mozilla. 14 May 2024. Archived 15 June 2024 at the Wayback Machine. Retrieved 15 May 2026.
  38. ^ "A Vulnerability in Mozilla PDF.js Could Allow for Arbitrary Code Execution". its.ny.gov. New York State Office of Information Technology Services. 2024. Retrieved 15 May 2026.
  39. ^ "High-Severity Vulnerability in Mozilla PDF.js". Cyber Security Agency of Singapore. 2024. Archived 13 June 2025 at the Wayback Machine. Retrieved 15 May 2026.