[creatonez]

Occasionally there are remote code execution exploits. The javascript-based PDF rendering in Firefox and Chrome is usually safe from these, so most people who don't download a PDF reader aren't affected by this.

Edit: Turns out, the PDF parser in Chrome exists outside the webpage sandbox. Only Firefox has a pdf.js based PDF viewer. In Chrome, you have to use extensions to get the safer pdf.js based PDF reader.

[xena]

TBH, I wouldn't trust any PDF reader that has access to the network and disk outside the file that it is immediately reading.