CVE-2024-9393

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the "resource://pdf.js" origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full...