That reminded to disable javascript in pdfjs that is used in firefox.
Feel much safer!
Open about:config
Search for "pdfjs.enableScripting"
Set to false.
Apparently, it is set to false by default in Zen Browser. In my Firefox it was still true.
Whew! I didn't realize it was enabled already.
So you also disable it for normal browsing?