Am I Being Pwned?
Get started

Is iLovePDF 2 - Chrome Extension safe?

Low risk

iLovePDF 2 captures a screenshot of the active tab and transmits it as a base64 image to ilovepdf2.com when the user clicks the Screenshot button.

When a user clicks the Screenshot button in the extension popup, the extension calls chrome.tabs.captureVisibleTab to capture the current tab as a base64 PNG. The image is then POSTed in JSON format to https://ilovepdf2.com/extn/gmailfile.php with no user disclosure of the upload destination. The extension provides no confirmation dialog or indication that the screenshot leaves the browser.

rehmat.ali.analystv1.6Chrome Web Store
17Risk
Who publishes it

rehmat.ali.analyst - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
rehmat.ali.analyst
Website
ilovepdf2.com/contact-us/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Tab screenshot uploaded to ilovepdf2.com when you click Screenshot

HighunwantedCWE-359Dynamic sandbox

Clicking iLovePDF 2's Screenshot tile captures the active tab and uploads it to ilovepdf2.com before any save dialog, no prompt shown.

What actually happens

You did this

You click the Screenshot tile in the iLovePDF 2 popup.

The tile is the element #screenshot-button in the extension popup.

The extension did this

The extension captures the visible tab and uploads the image to ilovepdf2.com.

captureVisibleTab returns an image of the active tab, which is POSTed to ilovepdf2.com before any save dialog is shown.

The code that does this

The click handler captures the active tab and POSTs the image to ilovepdf2.com.

Readable version

Capture the active tab on click

content.js
// When the Screenshot tile is clicked, find the active tab and// take a picture of whatever is currently visible in it.screenshotButton.addEventListener("click", function () {  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    chrome.tabs.captureVisibleTab(tabs[0].windowId, {}, function (screenshotUrl) {      // screenshotUrl is a base64 image of the visible tab

Upload the captured image

content.js
      // Send the captured image to ilovepdf2.com with no      // confirmation prompt and no on-screen destination disclosure.      fetch("https://ilovepdf2.com/extn/gmailfile.php", {        method: "POST",        body: JSON.stringify({ data: screenshotUrl, filename: "filename.jpg", extfile: "true" })      });

Captured request

POSThttps://ilovepdf2.com/extn/gmailfile.php

Captured during dynamic analysis after clicking the Screenshot tile: one POST (status 200) carrying a 62 KB JSON body whose 'data' field holds a base64-encoded JPEG of the active tab. The base64 string is shortened here for display; the full image was transmitted. The server replies with a URL that the extension then opens on ilovepdf2.com.

Body
{  "data": "data:image/jpeg;base64,/9j/4AAQSkZJRg...EAREQBERAEREAVKa1/dVS/kTP25ERAf/9k=",  "filename": "filename.jpg",  "extfile": "true"}

What the upload request contains.

  • Image of your current tab
    data:image/jpeg;base64,/9j/4AAQSkZJRg...Af/9k=

    A base64-encoded picture of the active tab when you click Screenshot, potentially including an open email or document.

  • File name
    filename.jpg

    A fixed file name the server associates with the uploaded image.

  • Upload flag
    true

    A flag that tells the server this request is an extension file upload.

It runs on every site

The content script is registered for every site (<all_urls> in the manifest), so the active tab being captured can be any page you have open at the time, not only iLovePDF pages.

What it can do

Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed iLovePDF 2 - Chrome Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ilovepdf2.com

    iLovePDF 2 - Chrome Extension sends data to ilovepdf2.com. No other extension we have analyzed sends data here.

Updated 30 September 2026afonhkadcnmockoncjdnlkmmopogdhkf