Is iLovePDF 2 - Chrome Extension safe?

Low risk

iLovePDF 2 captures a screenshot of the active tab and transmits it as a base64 image to ilovepdf2.com when the user clicks the Screenshot button.

When a user clicks the Screenshot button in the extension popup, the extension calls chrome.tabs.captureVisibleTab to capture the current tab as a base64 PNG. The image is then POSTed in JSON format to https://ilovepdf2.com/extn/gmailfile.php with no user disclosure of the upload destination. The extension provides no confirmation dialog or indication that the screenshot leaves the browser.

rehmat.ali.analystv1.6Chrome Web Store
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Tab screenshot uploaded to ilovepdf2.com when you click Screenshot

Clicking iLovePDF 2's Screenshot tile captures the active tab and uploads it to ilovepdf2.com before any save dialog, no prompt shown.

Testing showed one POST to ilovepdf2.com/extn/gmailfile.php carrying a base64 JPEG (~62 KB) of the tab.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click the Screenshot tile in the iLovePDF 2 popup.

The tile is the element #screenshot-button in the extension popup.

The extension did this

The extension captures the visible tab and uploads the image to ilovepdf2.com.

captureVisibleTab returns an image of the active tab, which is POSTed to ilovepdf2.com before any save dialog is shown.

02EvidenceCODE COMPARE
The code that does this

The click handler captures the active tab and POSTs the image to ilovepdf2.com.

What it actually does
Capture the active tab on clickcontent.js
// When the Screenshot tile is clicked, find the active tab and
// take a picture of whatever is currently visible in it.
screenshotButton.addEventListener("click", function () {
  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {
    chrome.tabs.captureVisibleTab(tabs[0].windowId, {}, function (screenshotUrl) {
      // screenshotUrl is a base64 image of the visible tab
Upload the captured imagecontent.js
      // Send the captured image to ilovepdf2.com with no
      // confirmation prompt and no on-screen destination disclosure.
      fetch("https://ilovepdf2.com/extn/gmailfile.php", {
        method: "POST",
        body: JSON.stringify({ data: screenshotUrl, filename: "filename.jpg", extfile: "true" })
      });
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://ilovepdf2.com/extn/gmailfile.php
Captured during dynamic analysis after clicking the Screenshot tile: one POST (status 200) carrying a 62 KB JSON body whose 'data' field holds a base64-encoded JPEG of the active tab. The base64 string is shortened here for display; the full image was transmitted. The server replies with a URL that the extension then opens on ilovepdf2.com.
Body
{
  "data": "data:image/jpeg;base64,/9j/4AAQSkZJRg...EAREQBERAEREAVKa1/dVS/kTP25ERAf/9k=",
  "filename": "filename.jpg",
  "extfile": "true"
}
04EvidenceFIELD TABLE
What the upload request contains.
FieldValueWhy it matters
Image of your current tab
data:image/jpeg;base64,/9j/4AAQSkZJRg...Af/9k=A base64-encoded picture of the active tab when you click Screenshot, potentially including an open email or document.
File name
filename.jpgA fixed file name the server associates with the uploaded image.
Upload flag
trueA flag that tells the server this request is an extension file upload.
05EvidencePLAIN NOTE
It runs on every site

The content script is registered for every site (`<all_urls>` in the manifest), so the active tab being captured can be any page you have open at the time, not only iLovePDF pages.

Data recipients

ilovepdf2.com
Updated 17 September 2026afonhkadcnmockoncjdnlkmmopogdhkf