`annotation_layer.js` has logic to keep input elements in sync. The logic uses `document.getElementsByName` with [a name derived from the PDF](https://github.com/mozilla/pdf.js/blob/10a1db698047e612e8ae3da66d12a6c1ac5597a3/src/core/annotation.js#L407) to retrieve the set of related elements. This query is not namespaced, so if the viewer ever adds a `name` attribute to a checkbox or radio input in the page, then the PDF file can get it changed (without user interaction via the scripting interface). Fortunately, there doesn't appear to be any input/radio element in the default viewer code. A custom viewer can be affected by this bug, however.

I suggest to replace the `document.getElementsByTagName` calls with a function that checks that the elements are created by the `annotation_layer.js` code before returning them. There are several ways to do so, e.g. by adding a custom attribute to each input element.

## Seemingly generic property assignment
This code on its own looks dangerous because it allows the caller to overwrite any property
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L684-L688
Fortunately, it is only called with a fixed key, so only the `value` property can be updated in response to user input events:
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L732-L740

## Unchecking other checkboxes on checkbox state change
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L979-L990

## Updating the abstract state (storage)
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L1061-L1065

## Allowing scripts to uncheck checkbox/radio inputs
The others require user interaction to have any effect; this one allows scripts embedded in the PDF to run logic without user interaction.
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L1073-L1077
* @property {number} [length] - The PDF file length. It's used for progress
 *   reports and range requests operations.
 * @property {PDFDataRangeTransport} [range] - Allows for using a custom range
 *   transport implementation.
 * @property {number} [rangeChunkSize] - Specify maximum number of bytes fetched
 *   per range request. The default value is {@link DEFAULT_RANGE_CHUNK_SIZE}.
 * @property {PDFWorker} [worker] - The worker that will be used for loading and
 *   parsing the PDF data.
 * @property {number} [verbosity] - Controls the logging level; the constants
 *   from {@link VerbosityLevel} should be used.
 * @property {string} [docBaseUrl] - The base URL of the document, used when
 *   attempting to recover valid absolute URLs for annotations, and outline
 *   items, that (incorrectly) only specify relative URLs.
 * @property {string} [cMapUrl] - The URL where the predefined Adobe CMaps are
 *   located. Include the trailing slash.
 * @property {boolean} [cMapPacked] - Specifies if the Adobe CMaps are binary
 *   packed or not.
 * @property {Object} [CMapReaderFactory] - The factory that will be used when
 *   reading built-in CMap files. Providing a custom factory is useful for
 *   environments without Fetch API or `XMLHttpRequest` support, such as
 *   Node.js. The default value is {DOMCMapReaderFactory}.
 * @property {boolean} [useSystemFonts] - When `true`, fonts that aren't
 *   embedded in the PDF document will fallback to a system font.
 *   The default value is `true` in web environments and `false` in Node.js;
 *   unless `disableFontFace === true` in which case this defaults to `false`
 *   regardless of the environment (to prevent completely broken fonts).
 * @property {string} [standardFontDataUrl] - The URL where the standard font
 *   files are located. Include the trailing slash.
 * @property {Object} [StandardFontDataFactory] - The factory that will be used
 *   when reading the standard font files. Providing a custom factory is useful