Comment by cesarb

How many PDF.js security vulnerabilities have been found so far?

A quick Google search found only four:

https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combined with a separate vulnerability" to be exploitable)

https://www.mozilla.org/en-US/security/advisories/mfsa2015-7... (this one)

It still is looking better than the plugin it replaced.