CORS is already enabled on some Dropbox domains, so it can be possible to embed PDFs directly from Dropbox, although only if your site is running under HTTPS. Try the following. Obtain the 'share' link from Dropbox ('Copy Dropbox link' from the right-click menu in your file browser). It should be something like this:
You need to change the domain to dl.dropboxusercontent.com and the dl=0 parameter to 1. So you end up with a shortcode as follows:
If you obtain the link from a Public folder, you may only need to change the dl=0 to dl=1 in order for it to work.