Is Download All PDFs safe?
Download All PDFs is high risk. On first install, the extension generates a 16-char ID stored permanently in local storage; it never changes. Every record sent to the developer's server carries this ID in 'uid', letting the developer link your full browsing history.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension Assigns Each Browser a Persistent Tracking ID Sent With Every Request
On first install, the extension generates a 16-char ID stored permanently in local storage; it never changes.
Every record sent to the developer's server carries this ID in 'uid', letting the developer link your full browsing history.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension for the first time.
background.js runs on browser startup and checks whether a tracking ID has already been created.
The extension automatically generates a unique identifier and stores it permanently so it can be attached to every future browsing record.
The same ID appears in every POST to service.download-all-pdfs.com/check_links for the lifetime of the installation.
This 16-char value is your browser's permanent ID, from live DA, unchanged across all three POSTs to service.download-all-pdfs.com.
- Location
- chrome.storage.local key 'dapClientId'
{ "dapClientId": "19d9e4a12c10689e"}Tracking ID generation and persistence (background.js function B/U)
async function getOrCreateTrackingId() { const stored = await chrome.storage.local.get(['dapClientId']); const existing = stored['dapClientId']; if (existing && typeof existing === 'string') { return existing; // reuse the existing persistent ID } // Generate new 16-char hex ID from timestamp + random const newId = (Date.now().toString(16) + Math.random().toString(16).substring(2)).substring(0, 16); await chrome.storage.local.set({ dapClientId: newId }); return newId;}Same uid value (19d9e4a12c10689e) present in all three captured POSTs across different pages and navigations, confirming the ID is stable.
- Content-Type
- application/json
{ "m": "do-ch", "uid": "19d9e4a12c10689e", "ev": "2.0.0", "ct": "text/html", "t": 1776477288604, "nm": "url_rewrite", "nt": "foreground", "u": "https://www.amazon.com/", "r": "https://www.amazon.com/", "links": []}PDF Downloader Sends Full Browsing History to Remote Server on Every Page Visit
Every time you visit a page, Download All PDFs collects the URL, referrer, content type, and PDF links found, plus a persistent tracking ID, and POSTs this to the developer's server on all pages, not just where you use the PDF feature.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any web page.
The extension's content script is active on all HTTP and HTTPS pages by manifest declaration.
The extension transmits the page URL, referrer, content type, and PDF links to service.download-all-pdfs.com.
This happens automatically 300 ms after the page loads, regardless of whether you use the PDF download feature.
Server returns JSON with bad_links and unknown_links arrays.
- Content-Type
- application/json
{ "m": "do-ch", "uid": "19d9e4a12c10689e", "ev": "2.0.0", "ct": "text/html", "t": 1776477287315, "nm": "request", "nt": "foreground", "u": "https://www.amazon.com/", "r": "https://www.google.com/", "links": []}- Page URLhttps://www.amazon.com/gp/cart/view.html?ref_=nav_cart
The full address of every page you visit, including query parameters that may hold search terms, session tokens, or account identifiers.
- Referrer URLhttps://www.google.com/search?q=amazon+deals
The address of the previous page you were on, revealing your navigation path and linking consecutive visits together.
- Persistent tracking ID19d9e4a12c10689e
A unique identifier generated on first install and stored permanently. It ties every browsing record back to your browser across sessions.
- Content typetext/html
The MIME type of the page (e.g. text/html, application/pdf), indicating what kind of content you are viewing.
- Extension version2.0.0
The installed version of the extension, sent with every request.
- PDF links on page["https://example.com/annual-report-2025.pdf"]
Up to 500 URLs of PDF files detected on the page, revealing what documents are available at the sites you visit.
Message dispatch in content.js (the data collection call)
chrome.runtime.sendMessage({ action: 'dap-collect', u: location.href, // current page URL ct: document.contentType || 'text/html', r: referrer || document.referrer || '', links: pdfLinks, // up to 500 PDF URLs from page isDynamic: isSpaNavigation});Payload assembly and POST in background.js (function W / Y in deobfuscated source)
const payload = { m: 'do-ch', uid: dapClientId, // persistent 16-char hex tracking ID ev: manifest.version, ct: contentType, t: Date.now(), nm: isDynamic || referrer ? 'url_rewrite' : 'request', nt: 'foreground', u: pageUrl, r: referrer, links: pdfLinks};await enqueueAndPost(payload);await fetch('https://service.download-all-pdfs.com/check_links', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload)});- service.download-all-pdfs.com
Receives a POST containing the page URL, referrer, content type, persistent user ID, and PDF links for every page navigation. Operated by the Download All PDFs extension developer.
Extension Polls Every 800ms to Capture and Transmit In-Page Navigation Events
The extension polls every 800ms for URL changes, including hash/history-API navigation in single-page apps.
On change it sends the new and prior URL as referrer to the developer's server; busy sites can trigger dozens of sends per session.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate within a single-page application (e.g. clicking between pages on a social media or productivity site).
The URL changes without a full page reload, using the History API, hash fragments, or popstate events.
The extension captures the new URL and your previous location and transmits both to the developer's server within 800 ms.
The polling loop catches the URL change, packages the old URL as a referrer, and triggers a POST to service.download-all-pdfs.com/check_links.
Every 0.8 seconds
Polls location.href every 800 milliseconds while any HTTP/HTTPS page is open, transmitting a data record to service.download-all-pdfs.com whenever the URL changes.
Polling loop and SPA navigation listeners in content.js
// Navigation change detector — fires every 800ms and on popstate/hashchangefunction checkForNavigation() { const currentUrl = location.href; if (currentUrl === cachedUrl) return; // no change const previousUrl = cachedUrl; cachedUrl = currentUrl; sendCollectionMessage(previousUrl, /*isDynamic=*/true);}// Set up continuous polling and SPA event listenerssetInterval(checkForNavigation, 800);window.addEventListener('popstate', checkForNavigation);window.addEventListener('hashchange', checkForNavigation);Second POST fired 1289ms after the first on the same amazon.com page navigation, confirming the 800ms polling loop fires on in-page URL changes. nm=url_rewrite signals an SPA/polling-triggered event vs the initial nm=request.
- Content-Type
- application/json
{ "m": "do-ch", "uid": "19d9e4a12c10689e", "ev": "2.0.0", "ct": "text/html", "t": 1776477288604, "nm": "url_rewrite", "nt": "foreground", "u": "https://www.amazon.com/", "r": "https://www.amazon.com/", "links": []}