This was reported on https://github.com/webcompat/web-bugs/issues/5095

It appears as though cuoc.org.uk is sending this CSP header:
default-src 'self'; script-src 'self' 'unsafe-inline' www.google-analytics.com; img-src * data:; child-src 'none'; object-src 'none'; media-src 'none'; block-all-mixed-content

And because we use use an <embed> object in https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/html/PluginDocument.cpp, it fails like this:
Refused to load plugin data from 'https://cuoc.org.uk/docs/2016_risk_assessment.pdf' because it violates the following Content Security Policy directive: "object-src 'none'".

I've confirmed that it works on a server without a CSP header.