`annotation_layer.js` has logic to keep input elements in sync. The logic uses `document.getElementsByName` with [a name derived from the PDF](https://github.com/mozilla/pdf.js/blob/10a1db698047e612e8ae3da66d12a6c1ac5597a3/src/core/annotation.js#L407) to retrieve the set of related elements. This query is not namespaced, so if the viewer ever adds a `name` attribute to a checkbox or radio input in the page, then the PDF file can get it changed (without user interaction via the scripting interface). Fortunately, there doesn't appear to be any input/radio element in the default viewer code. A custom viewer can be affected by this bug, however.

I suggest to replace the `document.getElementsByTagName` calls with a function that checks that the elements are created by the `annotation_layer.js` code before returning them. There are several ways to do so, e.g. by adding a custom attribute to each input element.

## Seemingly generic property assignment
This code on its own looks dangerous because it allows the caller to overwrite any property
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L684-L688
Fortunately, it is only called with a fixed key, so only the `value` property can be updated in response to user input events:
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L732-L740

## Unchecking other checkboxes on checkbox state change
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L979-L990

## Updating the abstract state (storage)
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L1061-L1065

## Allowing scripts to uncheck checkbox/radio inputs
The others require user interaction to have any effect; this one allows scripts embedded in the PDF to run logic without user interaction.
https://github.com/mozilla/pdf.js/blob/99e442941c16561e8826a925b164d79f4ad51fbf/src/display/annotation_layer.js#L1073-L1077
*   for environments without Fetch API or `XMLHttpRequest` support, such as
 *   Node.js. The default value is {DOMStandardFontDataFactory}.
 * @property {boolean} [useWorkerFetch] - Enable using the Fetch API in the
 *   worker-thread when reading CMap and standard font files. When `true`,
 *   the `CMapReaderFactory` and `StandardFontDataFactory` options are ignored.
 *   The default value is `true` in web environments and `false` in Node.js.
 * @property {boolean} [stopAtErrors] - Reject certain promises, e.g.
 *   `getOperatorList`, `getTextContent`, and `RenderTask`, when the associated
 *   PDF data cannot be successfully parsed, instead of attempting to recover
 *   whatever possible of the data. The default value is `false`.
 * @property {number} [maxImageSize] - The maximum allowed image size in total
 *   pixels, i.e. width * height. Images above this value will not be rendered.
 *   Use -1 for no limit, which is also the default value.
 * @property {boolean} [isEvalSupported] - Determines if we can evaluate strings
 *   as JavaScript. Primarily used to improve performance of font rendering, and
 *   when parsing PDF functions. The default value is `true`.
 * @property {boolean} [disableFontFace] - By default fonts are converted to
 *   OpenType fonts and loaded via the Font Loading API or `@font-face` rules.
 *   If disabled, fonts will be rendered using a built-in font renderer that
 *   constructs the glyphs with primitive path commands.
 *   The default value is `false` in web environments and `true` in Node.js.
 * @property {boolean} [fontExtraProperties] - Include additional properties,
 *   which are unused during rendering of PDF documents, when exporting the
 *   parsed font data from the worker-thread. This may be useful for debugging
 *   purposes (and backwards compatibility), but note that it will lead to
 *   increased memory usage. The default value is `false`.
 * @property {boolean} [enableXfa] - Render Xfa forms if any.
 *   The default value is `false`.
 * @property {HTMLDocument} [ownerDocument] - Specify an explicit document
 *   context to create elements with and to load resources, such as fonts,