Actually, I'm pretty sure that's used to let you read webpages stored on file://. That's a feature that has been present in browsers since ~1993. I don't think you can deactivate it.
> And what a pdf reader has to do with javascript is a mystery as well.
It's a pdf reader written in JavaScript, just as there are other pdf readers written in other programming languages.
In that case, is the issue actually specific to pdf.js? If it's written entirely in javascript, could this not be exploited some other way? Or does pdf.js have special permissions in this context?
> And what a pdf reader has to do with javascript is a mystery as well.
It's a pdf reader written in JavaScript, just as there are other pdf readers written in other programming languages.