If I'm reading the disclosure right, the injection is into a non-privileged part of the PDF reader. But the PDF reader is loaded from the local filesystem, so p

If I'm reading the disclosure right, the injection is into a non-privileged part of the PDF reader. But the PDF reader is loaded from the local filesystem, so presumably that means it has access to files on the local filesystem and can disclose them to a third party. This would be a violation of the same-origin policy, since the PDF is coming from a network origin and shouldn't be able to touch local files. I'm not totally clear on this though, since usually file:// is treated specially to avoid security exploits. Maybe PDF.js is loaded from a local filesystem origin that doesn't have those restrictions (chrome:// or something equivalent)