I think I disabled it a while ago due to the local file disclosure issue, but I can't be certain. Does the latest stable TBB (5.0.3) have this enabled by default? It's really handy to read PDFs with pdf.js, but I don't want it enabled unless it is supposed to be.
1 Answer
Yes pdf.js is enabled by default. It is preferred to use this rather than downloading the actual pdf. In general pdfs tend to be a security risk though.
Although old, here is some more information regarding pdf.js in TBB pdf files opening on new tab on-click, is it safe?
Note: I would suggest using tails if you are viewing PDFs over Tor often.