In GNOME 3.36, Web gained native support for PDF documents by using PDF.js. Michael Catanzaro explained that having websites open Evince to display PDF files was insecure, as it could be used to escape the browser's security sandbox. Since Evince was the last user of NPAPI, this allowed the remaining support code for the obsolete plug-in model (where additional vulnerabilities could be hiding) to be removed. Since the NPAPI support had a hard dependency on X11, moving to PDF.js also allowed that dependency to be dropped.