Running JavaScript inside PDFs is a bad idea and Mozilla previously disabled it by default. But now with FireFox 88 this option is ENABLED by default. Which means, if a PDF file contains JS it will run without any user interaction. What can possibly go wrong?
To disable this: about:config pdfjs.enableScripting –> false