[yencabulator]

And if they had used PDF.js incorrectly in the browser, it would allow XSS attacks on the domain used for MS Teams.