CVE-2026-16633 - PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

HIGH

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Published Aug 6, 2026

8.6

HIGH

CVSS 4.0

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Ecosystem	Package	Introduced	Fixed
npm	pdfjs-dist	5.6.83	6.2.108

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2055885
https://github.com/advisories/GHSA-hq66-cqwq-w95j		Advisory
https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j

No recorded changes yet.

Sources

Status n/a

Assigner n/a

Published Aug 6, 2026

Updated n/a

Reserved n/a

Updated n/a

Status n/a

Modified n/a

Severity n/a

Public date n/a