CVE-2026-16633: 
JavaScript vulnerability analysis and mitigation

CVE-2026-16633 is an arbitrary JavaScript execution vulnerability in PDF.js (pdfjs-dist) that allows attacker-controlled JavaScript to run in the context of the hosting domain when a malicious PDF is opened. It affects pdfjs-dist npm package versions >= 5.6.83 and < 6.2.108, with version 6.2.108 containing the fix. The vulnerability was published by Mozilla maintainer calixteman on July 28, 2026, and added to the GitHub Advisory Database on August 6, 2026. It carries a CVSS v4 base score of 8.6 (High) (GitHub Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79 / Cross-Site Scripting). When PDF.js is configured with enableScripting set to true (the default) and no Content Security Policy (CSP) restricting script-src is in place, JavaScript embedded in a crafted PDF document is executed without restriction in the browser context of the hosting domain. The attack vector is network-based, requires no privileges, and only requires passive user interaction — specifically, a user opening or viewing a malicious PDF file through an application using the vulnerable library. The vulnerability was discovered by security researcher wlayzz (GitHub Advisory, Mozilla Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the security context of the domain hosting the PDF.js viewer, effectively achieving XSS with full access to that origin's cookies, session tokens, local storage, and DOM. This can lead to credential theft, session hijacking, unauthorized actions performed on behalf of the victim user, and potential data exfiltration from the hosting application. Downstream packages such as ngx-extended-pdf-viewer that bundle vulnerable versions of PDF.js are also affected, broadening the attack surface (GitHub Advisory, Offseq Radar).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed at the time of this report. The CVE status remains "Reserved" and no EPSS score or CISA KEV catalog entry has been published. However, the low attack complexity, no privilege requirement, and passive user interaction threshold make this vulnerability relatively easy to weaponize — an attacker only needs to convince a user to open a crafted PDF in an application using the vulnerable library (GitHub Advisory).

1. Craft a malicious PDF: Create a PDF document containing embedded JavaScript (using PDF scripting features such as AcroForm actions or document-level scripts) designed to execute attacker-controlled code.
2. Identify a target application: Locate a web application using pdfjs-dist versions >= 5.6.83 and < 6.2.108 with enableScripting set to true (the default) and no restrictive script-src CSP header.
3. Deliver the malicious PDF: Host the crafted PDF on an attacker-controlled server or distribute it via phishing, email attachment, or a malicious link that causes the target application to load and render the PDF.
4. Trigger user interaction: Induce the victim to open or preview the PDF within the vulnerable application — this constitutes the required passive user interaction.
5. Execute arbitrary JavaScript: Upon rendering, PDF.js processes the embedded scripts and executes the attacker's JavaScript in the hosting domain's context, enabling session token theft, credential harvesting, DOM manipulation, or further exploitation (GitHub Advisory, Mozilla Advisory).

• Network: Unexpected outbound HTTP requests from the browser to attacker-controlled domains originating from a page hosting a PDF viewer; exfiltration of cookies or tokens via fetch/XMLHttpRequest to external endpoints.
• Logs: Web server or CDN logs showing delivery of PDF files from untrusted or external sources to PDF.js-powered viewer endpoints; CSP violation reports (if CSP is partially configured) triggered by script execution.
• Browser/Application: JavaScript errors or unexpected DOM modifications occurring immediately after a PDF is opened in the viewer; unusual document.cookie access or localStorage reads logged by browser developer tools or security monitoring extensions.

The primary remediation is to upgrade pdfjs-dist to version 6.2.108 or later, which contains the patch for this vulnerability (GitHub Advisory). If an immediate upgrade is not feasible, two workarounds are available: (1) set the enableScripting configuration option to false when initializing PDF.js to disable PDF JavaScript execution entirely, or (2) implement a strict Content Security Policy (CSP) with a script-src directive that disallows inline scripts and untrusted sources. Downstream packages such as ngx-extended-pdf-viewer that bundle PDF.js should also be updated to versions that incorporate the patched pdfjs-dist (Offseq Radar).

The vulnerability was flagged by threat intelligence platforms including Tenable and Offseq Radar shortly after disclosure, with Offseq specifically noting the impact on downstream packages like ngx-extended-pdf-viewer (Offseq Radar). No major public researcher commentary or broad social media discussion has been identified at this time.