

Sure, in Firefox itself it wasn’t a severe vulnerability. It’s way worse on standalone PDF readers, though:
In applications that embed PDF.js, the impact is potentially even worse. If no mitigations are in place (see below), this essentially gives an attacker an XSS primitive on the domain which includes the PDF viewer. Depending on the application this can lead to data leaks, malicious actions being performed in the name of a victim, or even a full account take-over. On Electron apps that do not properly sandbox JavaScript code, this vulnerability even leads to native code execution (!). We found this to be the case for at least one popular Electron app.
Oh, that’s really cool. I hope there’s more linkage between the twitter-like and reddit-like islands of the fediverse in the future; I’m somewhat interested in reading the former but it seems to be complicated to actually get federation with it.