{{Short description|PDF viewer in JavaScript included in Mozilla Firefox}} {{Use dmy dates|date=October 2020}}
{{Infobox software | name = PDF.js | logo = Pdf-js logo.svg | screenshot = PDF js Screenshot in Firefox 100.png | caption = PDF.js in Firefox 100, with a table of contents displayed on the sidebar | collapsible = | author = Andreas Gal | developer = Mozilla | released = {{Start date|2011|07|02|df=yes}}<ref name="PDF.js repo">{{cite web |title = Releases · mozilla/pdf.js |url = https://github.com/mozilla/pdf.js/releases |access-date = 12 March 2021 |website = GitHub}}</ref> | latest release version = {{wikidata|property|edit|reference|P348}} | latest release date = {{start date and age|{{wikidata|qualifier|mdy|P348|P577}}}} | programming language = JavaScript, CSS, HTML | size = 3.94 MB<ref name="PDF.js repo" /> | platform = JavaScript engine, web browser | genre = PDF viewer | license = Apache License 2.0<ref>{{cite web |url = https://github.com/mozilla/pdf.js/blob/master/LICENSE |title = pdf.js/LICENSE at master · mozilla/pdf.js |website = GitHub|date = 17 February 2022 }}</ref> | website = {{URL|https://mozilla.github.io/pdf.js/}} }}
'''PDF.js''' is a JavaScript library that renders Portable Document Format (PDF) files using the web standards-compliant HTML5 Canvas. The project is led by the Mozilla Corporation after Andreas Gal launched it (initially as an experiment) in 2011.
== History and application ==
PDF.js was originally created as an extension for Firefox<ref name=":0">{{cite web|title = PDF Viewer(discontinued) |url = https://addons.mozilla.org/en-US/firefox/addon/pdfjs/|website = addons.mozilla.org |access-date = 2015-12-02 |archive-url = https://web.archive.org/web/20151205121858/https://addons.mozilla.org/en-US/firefox/addon/pdfjs/|archive-date = 5 December 2015}}</ref> and is included in Firefox since 2012 (version 15),<ref>{{cite web |title=PDF.JS and Download Manager Panel Pushed to Firefox 15 |first=Lucian |last=Parfeni |url=https://news.softpedia.com/news/PDF-JS-and-Download-Manager-Panel-Pushed-to-Firefox-15-267154.shtml |website=Softpedia |publisher=SoftNews |date=2012-04-30|access-date=15 May 2026}}</ref><ref>{{cite web |title = Вышла новая версия браузера Firefox 15 | first = Anton | last = Blagoveschenskiy | url = https://www.rg.ru/2012/08/29/firefox-site-anons.html | newspaper = Rossiyskaya Gazeta | date = 2012-08-29 | access-date = 2012-09-09 | language = ru |trans-title = New version 15 of the Firefox browser released }}</ref> and enabled by default since 2013 (version 19).<ref>{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=773397|title=Bug 773397 – Disable pdf.js prior to FF15 beta 5|website=bugzilla.mozilla.org|access-date=15 May 2026}}</ref><ref name="Firefox Notes - Desktop">{{cite web|title=Firefox 19.0 Release Notes|url=https://www.mozilla.org/en-US/firefox/19.0/releasenotes/|access-date=30 April 2013|website=mozilla.org}}</ref> It was added to Firefox for Android in 2023 (version 111).<ref>{{Cite web|url=https://www.mozilla.org/en-US/firefox/android/111.0/releasenotes/ |title=Firefox for Android 111.0, See All New Features, Updates and Fixes |website=www.mozilla.org |access-date=19 April 2024}}</ref><ref>{{Cite web |last=Adhikari |first=Sumit |date=2023-03-16 |title=Firefox 111 for Android brings Total Cookie Protection & PDF viewer |url=https://www.androidheadlines.com/2023/03/firefox-111-android-total-cookie-protection-pdf-viewer.html |access-date=2026-05-15 |website=Android Headlines}}</ref>
The project was created to provide a way for viewing PDF documents natively in the web browser, which prevents potential security risks when opening PDF documents outside a browser, as the code for displaying the document is sandboxed in a browser.<ref name=":2">{{Cite web |last=Shankland |first=Stephen |date=2011-06-24 |title=Mozilla eyes hassle-free PDFs on the Web |url=https://www.cnet.com/culture/mozilla-eyes-hassle-free-pdfs-on-the-web/ |access-date=2022-05-24 |website=CNET |language=en}}</ref> Its implementation uses the Canvas element from HTML5, which allows for fast rendering speeds.<ref name=":2" />
PDF.js is also used in Thunderbird,<ref>{{Cite web|title=810815 - Integrate pdf.js to Thunderbird|url=https://bugzilla.mozilla.org/show_bug.cgi?id=810815|access-date=2022-01-28|website=bugzilla.mozilla.org|language=en}}</ref> ownCloud,<ref>{{Citation|title=owncloud/files_pdfviewer|date=2020-02-08|url=https://github.com/owncloud/files_pdfviewer|publisher=ownCloud|access-date=2020-03-28}}</ref> Nextcloud,<ref>{{Citation|title=nextcloud/files_pdfviewer|date=2020-03-18|url=https://github.com/nextcloud/files_pdfviewer|publisher=Nextcloud|access-date=2020-03-28}}</ref><ref>{{Cite web|url=https://apps.nextcloud.com/apps/files_pdfviewer|title=PDF viewer - Apps - App Store - Nextcloud|website=apps.nextcloud.com|access-date=2020-03-28}}</ref> and is available as a browser extension for Google Chrome/Chromium,<ref>{{cite web|url=https://chrome.google.com/webstore/detail/pdf-viewer/oemmndcbldboiebfnladdacbdfmadadm|title=PDF Viewer|website=Chrome Web Store|access-date=15 May 2026}}</ref> Pale Moon<ref>{{cite web|title=Add-ons - Moon PDF Viewer|url=https://addons.palemoon.org/addon/moon-pdf-viewer|archive-url=https://web.archive.org/web/20200103222159/https://addons.palemoon.org/addon/moon-pdf-viewer/|archive-date=January 3, 2020|access-date=May 4, 2021|website=Pale Moon - Add-ons}}</ref><ref name=":1">{{Cite web|title=IsaacSchemm/pdf.js-seamonkey: SeaMonkey fork of pdf.js|url=https://github.com/IsaacSchemm/pdf.js-seamonkey|url-status=live|archive-url=https://web.archive.org/web/20201206160734/https://github.com/IsaacSchemm/pdf.js-seamonkey|archive-date=December 6, 2020|access-date=May 4, 2021|website=GitHub}}</ref> and SeaMonkey.<ref name=":1" /><ref>{{cite web|title=PDF Viewer for SeaMonkey|url=https://addons.thunderbird.net/seamonkey/addon/pdf-js-for-seamonkey|website=Add-ons for SeaMonkey|date=25 April 2020|access-date=13 January 2020|archive-date=13 January 2020|archive-url=https://web.archive.org/web/20200113054940/https://addons.thunderbird.net/seamonkey/addon/pdf-js-for-seamonkey|url-status=dead}}</ref>
It can be integrated or embedded in a web or native application to enable PDF rendering and viewing, and allows advanced usages such as Server-side rendering.
Many web applications, including Dropbox,<ref>{{Cite web|last=Lauraharrisneal|title=Annotations on Document Previews|url=https://dropbox.tech/application/annotations-on-document-previews|access-date=2021-08-05|website=dropbox.tech|language=en}}</ref> Slack,<ref>{{Cite news|date=2016-11-16|title=What matters to you, matters to us. - Slack Engineering|language=en-US|work=Slack Engineering|url=https://slack.engineering/what-matters-to-you-matters-to-us-10ff49650a5d|access-date=2021-08-05}}</ref> and LinkedIn Learning<ref>{{Cite web|title=Under the hood: Learning with documents|url=https://engineering.linkedin.com/blog/2019/04/under-the-hood--learning-with-documents|access-date=2021-08-05|website=engineering.linkedin.com|language=en|date=24 April 2019|last=Rawat|first=Anurag}}</ref> integrate PDF.js to enable previewing PDF documents.
==Behavior==
According to a benchmark by Mozilla, PDF.js is performant for viewing most common PDF files, while it may have some issues with large or 'graphics-heavy' documents.<ref>{{Cite web|url=https://hacks.mozilla.org/2014/05/how-fast-is-pdf-js/|title=How fast is PDF.js? – Mozilla Hacks - the Web developer blog|date=8 May 2014|access-date=15 May 2026|website=Mozilla|last=Bochenek|first=Thorben}}</ref>
PDF.js supports most of the PDF specifications (including form support or XFA<ref>{{Cite web|title=1706133 - (pdf-xfa) [meta] XFA support|url=https://bugzilla.mozilla.org/show_bug.cgi?id=1706133|access-date=2022-01-28|website=bugzilla.mozilla.org|language=en}}</ref>), but some features have not been implemented yet, which may impact rendering behavior depending on the features the document uses.<ref>{{Cite web|title=Guide to Evaluating PDF.js Rendering|url=https://pdftron.com/blog/pdf-js/guide-to-pdf-js-rendering/|access-date=2021-08-05|website=PDFTron}}</ref>
Several PDF/X or optional PDF features that are not supported in PDF.js include:
* ICC Color Profiles<ref>{{Cite web |title=ICC profiles support for images · Issue #2856 · mozilla/pdf.js |url=https://github.com/mozilla/pdf.js/issues/2856 |access-date=2022-05-24 |website=GitHub |language=en}}</ref> * Spot colors *Overprint simulation<ref>{{Cite web |title=Overprint Support · Issue #7360 · mozilla/pdf.js |url=https://github.com/mozilla/pdf.js/issues/7360 |access-date=2022-05-24 |website=GitHub |language=en}}</ref> *Transparency groups (knockout/isolation)<ref>{{Cite web |title=Issue about knockout groups. · Issue #3136 · mozilla/pdf.js |url=https://github.com/mozilla/pdf.js/issues/3136 |access-date=2022-05-24 |website=GitHub |language=en}}</ref> *High-fidelity printing
The PDF.js contributor community also notes that the browser behavior of PDF.js varies with browser support for PDF.js's required features.<ref>{{Cite web|title=Frequently Asked Questions · mozilla/pdf.js Wiki|url=https://github.com/mozilla/pdf.js|access-date=2021-08-05|website=GitHub|language=en}}</ref> Performance and reliability will be the best on Chrome and Firefox, which are fully supported and subject to automated testing.
==Security== Because PDF.js parses untrusted documents inside the browser, it has been the subject of several disclosed vulnerabilities. In 2015, CVE-2015-2743 documented excessive privileges for internal workers in PDF.js, which was addressed in Firefox 39 and the ESR branches 31.8 and 38.1.<ref>{{cite web|title=CVE-2015-2743|url=https://www.cvedetails.com/cve/CVE-2015-2743/|access-date=15 May 2026|website=CVE Details|archive-url=https://web.archive.org/web/20160604104517/https://www.cvedetails.com/cve/CVE-2015-2743/|archive-date=4 June 2016}}</ref><ref>{{Cite web|title=cve-2015-2743|url=https://nvd.nist.gov/vuln/detail/cve-2015-2743|access-date=2026-05-15|website=nvd.nist.gov}}</ref> A related Metasploit module exploited a privileged JavaScript injection in Firefox 35 and 36 through the PDF viewer.<ref>{{cite web|date=2015|title=Mozilla Firefox 'pdf.js' Privileged JavaScript Injection (Metasploit)|url=https://www.exploit-db.com/exploits/37958|access-date=15 May 2026|website=Exploit Database|publisher=Offensive Security|id=EDB-ID:37958|archive-url=https://web.archive.org/web/20150912040424/https://www.exploit-db.com/exploits/37958/|archive-date=12 September 2015}}</ref>
In 2018, CVE-2018-5158 disclosed that PDF.js did not sufficiently sanitize PostScript calculator functions, allowing crafted PDF files to inject JavaScript with the privileges of the embedding page.<ref>{{Cite web|title=CVE-2018-5158|url=https://github.com/advisories/GHSA-7jg2-jgv3-fmr4|access-date=2026-05-15|website=GitHub Advisory Database}}</ref><ref>{{Cite web|title=CVE-2018-5158|url=https://nvd.nist.gov/vuln/detail/CVE-2018-5158|access-date=2026-05-15|website=nvd.nist.gov}}</ref><ref>{{cite web|title=CVE-2018-5158|url=https://www.cvedetails.com/cve/CVE-2018-5158/|access-date=15 May 2026|website=CVE Details|archive-url=https://web.archive.org/web/20190818233958/https://www.cvedetails.com/cve/CVE-2018-5158/|archive-date=18 August 2019}}</ref>
A more widely reported issue, CVE-2024-4367, was disclosed in May 2024 by researchers at Codean Labs.<ref>{{Cite web|title=cve-2024-4367|url=https://nvd.nist.gov/vuln/detail/cve-2024-4367|access-date=2026-05-15|website=nvd.nist.gov}}</ref> The vulnerability stems from a missing type check in PDF.js font handling, where a custom <code>FontMatrix</code> embedded in PDF metadata could be coerced into a string and reach <code>eval</code>, enabling arbitrary JavaScript execution within the PDF.js context.<ref>{{cite web|last1=Suijten|first1=Thomas|date=20 May 2024|title=CVE-2024-4367: Arbitrary JavaScript execution in PDF.js |url=https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/|access-date=15 May 2026|website=Codean Labs|archive-url=https://web.archive.org/web/20240620201654/https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/|archive-date=20 June 2024}}</ref> Mozilla addressed the issue in PDF.js 4.2.67, Firefox 126, Firefox ESR 115.11 and Thunderbird 115.11.<ref>{{cite web|date=14 May 2024|title=Security Vulnerabilities fixed in Firefox 126 — Mozilla Foundation Security Advisory 2024-21|url=https://ai-document-creator.pdffiller.com/|access-date=15 May 2026|website=Mozilla|archive-url=https://web.archive.org/web/20240615020837/https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/|archive-date=15 June 2024}}</ref> National advisories were issued by the New York State Office of Information Technology Services and the Cyber Security Agency of Singapore.<ref>{{cite web|date=2024|title=A Vulnerability in Mozilla PDF.js Could Allow for Arbitrary Code Execution|url=https://its.ny.gov/2024-046|access-date=15 May 2026|website=its.ny.gov|publisher=New York State Office of Information Technology Services}}</ref><ref>{{cite web|date=2024|title=High-Severity Vulnerability in Mozilla PDF.js|url=https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2024-061/|access-date=15 May 2026|website=Cyber Security Agency of Singapore|archive-url=https://web.archive.org/web/20250613231709/https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2024-061/|archive-date=13 June 2025|url-status=live}}</ref>
==See also== {{Portal|Free and open-source software}} *List of PDF software *ORBX.js * Shumway * JavaScript framework * JavaScript library
==References== {{Reflist}}
==External links== * {{Official site}} * {{cite web | url = https://support.mozilla.org/kb/view-pdf-files-firefox | title = View PDF files in Firefox | work = Firefox Help | publisher = Mozilla}} * {{cite web | url = https://andreasgal.com/2011/06/15/pdf-js/ | title = pdf.js: Rendering PDF with HTML5 and JavaScript |author=Chris Jones |author2=Andreas Gal |display-authors=etal | work = Andreas Gal's blog | date = 2011-06-15}} * {{cite web |url = https://webscripts.softpedia.com/blog/Script-of-the-Day-pdf-js-266909.shtml |title = Script of the Day: pdf.js |author = Catalin Cimpanu |work = Softpedia |date = 2012-05-03 |access-date = 3 January 2020 |archive-date = 13 January 2015 |archive-url = https://web.archive.org/web/20150113184320/https://webscripts.softpedia.com/blog/Script-of-the-Day-pdf-js-266909.shtml }}
{{Mozilla organisations}}
Category:Cross-platform free software Category:Firefox Category:Free PDF readers Category:Free web software Category:JavaScript libraries Category:Firefox extensions merged to Firefox