

Sure, in Firefox itself it wasn’t a severe vulnerability. It’s way worse on standalone PDF readers, though:
In applications that embed PDF.js, the impact is potentially even worse. If no mitigations are in place (see below), this essentially gives an attacker an XSS primitive on the domain which includes the PDF viewer. Depending on the application this can lead to data leaks, malicious actions being performed in the name of a victim, or even a full account take-over. On Electron apps that do not properly sandbox JavaScript code, this vulnerability even leads to native code execution (!). We found this to be the case for at least one popular Electron app.







In the US, you mean? From the top of my mind, advocating for more market freedom - unrestricted capitalism is a mixed bag generally, but the Biden administration was price-fixing insurance in the wake of California fires, which is a degree of economical illiteracy approaching Soviet Union levels.