> Regarding your security concern, Firefox's PDF viewer is PDF.js. Parsing PDF files in a JS sandbox and rendering it to an HTML <canvas> in a sandboxed process

> Regarding your security concern, Firefox's PDF viewer is PDF.js. Parsing PDF files in a JS sandbox and rendering it to an HTML <canvas> in a sandboxed process should be more secure than rendering it using an unsandboxed app that parses/renders using system APIs. Almost definitely. You can go to https://www.exploit-db.com/ https://www.exploit-db.com/ and search for PDF and see many application exploits for PDF viewers, and that includes for linux (and not just commercial applications, Poppler is on there as well, though more than just a few years back). PDFs have shown that they are a fertile ground for exploit, so running them though a sandboxed VM is a very good way to limit that problem to some degree.