Is iLovePDF 2 - Chrome Extension safe?
iLovePDF 2 captures a screenshot of the active tab and transmits it as a base64 image to ilovepdf2.com when the user clicks the Screenshot button.
When a user clicks the Screenshot button in the extension popup, the extension calls chrome.tabs.captureVisibleTab to capture the current tab as a base64 PNG. The image is then POSTed in JSON format to https://ilovepdf2.com/extn/gmailfile.php with no user disclosure of the upload destination. The extension provides no confirmation dialog or indication that the screenshot leaves the browser.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Tab screenshot uploaded to ilovepdf2.com when you click Screenshot
Clicking iLovePDF 2's Screenshot tile captures the active tab and uploads it to ilovepdf2.com before any save dialog, no prompt shown.
Testing showed one POST to ilovepdf2.com/extn/gmailfile.php carrying a base64 JPEG (~62 KB) of the tab.
You click the Screenshot tile in the iLovePDF 2 popup.
The tile is the element #screenshot-button in the extension popup.
The extension captures the visible tab and uploads the image to ilovepdf2.com.
captureVisibleTab returns an image of the active tab, which is POSTed to ilovepdf2.com before any save dialog is shown.
The click handler captures the active tab and POSTs the image to ilovepdf2.com.
// When the Screenshot tile is clicked, find the active tab and
// take a picture of whatever is currently visible in it.
screenshotButton.addEventListener("click", function () {
chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {
chrome.tabs.captureVisibleTab(tabs[0].windowId, {}, function (screenshotUrl) {
// screenshotUrl is a base64 image of the visible tab // Send the captured image to ilovepdf2.com with no
// confirmation prompt and no on-screen destination disclosure.
fetch("https://ilovepdf2.com/extn/gmailfile.php", {
method: "POST",
body: JSON.stringify({ data: screenshotUrl, filename: "filename.jpg", extfile: "true" })
});{
"data": "data:image/jpeg;base64,/9j/4AAQSkZJRg...EAREQBERAEREAVKa1/dVS/kTP25ERAf/9k=",
"filename": "filename.jpg",
"extfile": "true"
}| Field | Value | Why it matters | |
|---|---|---|---|
Image of your current tab | data:image/jpeg;base64,/9j/4AAQSkZJRg...Af/9k= | A base64-encoded picture of the active tab when you click Screenshot, potentially including an open email or document. | |
File name | filename.jpg | A fixed file name the server associates with the uploaded image. | |
Upload flag | true | A flag that tells the server this request is an extension file upload. |
The content script is registered for every site (`<all_urls>` in the manifest), so the active tab being captured can be any page you have open at the time, not only iLovePDF pages.