Cisco's Talos security research group publishes vulnerability reports, malware analysis, and threat write-ups on products such as PDFium, 7-Zip, and ntpd.
HN links it for vulnerability disclosures, notably the PDFium flaw in Chrome, which prompted commenters to discuss PDF plugin choices.
Right, PDFium is the default. I've been using the PDF.js plugin for a while now and disabled the default via chrome://plugins.
Fortunately Chrome stopped supporting Foxit and Adobe PDF plugins with version 45 (released a year ago) when they depreciated NPAPI.
> As of Chrome 45, support for old, insecure NPAPI plugins is permanently removed. I believe Adobe Reader and Foxit Reader both integrate with web browsers through NPAPI plugins. If so, the old NPAPI-based Adobe Reader and Foxit Reader no longer works in Chrome, regardless of whichever version you have installed. http://www.chromium.org/developers/npapi-deprecation
It's interesting that they still expose their own C++ code to remote PDFs which apparently had some servere bugs: http://blog.talosintel.com/2016/06/pdfium.html
http://blog.talosintel.com/2016/08/vulnerability-spotlight-multiple-dos.html