title: Can JavaScript running within a PDF access the domain it was downloaded from?
body: <p>This is a security question. Say User A is logged into example.com, and he then downloads a PDF hosted by example.com which he views within the browser. Is JavaScript embedded within the PDF able to access example.com's APIs as if it were the logged in User A?</p>
  
  <p>Or stated differently, do API calls originating from JavaScript within a PDF get sent to the server with the session cookie that the browser may be holding for that domain?</p>