I have told my users for years not to ever click on PDF Documents if they are not 100% sure they know where it came from as they can sometimes be the delivery vector for malicious code.
Recently, one of my users sent me a screenshot of an obvious scam email. They then proceeded to send me a screenshot of the PDF. I then asked them why they opened the PDF if they knew it was from a malicious source ... to which they answered "I didn't, I had google open it for me".
Are there any known vulnerabilities that exploit google's PDF viewer? Is the google pdf viewer sandboxed in such a way that prevents it from accessing the rest of your google account?