Is PDF Editor safe?

Question

Is PDF Editor safe?

Accepted Answer

PDF Editor is high risk. Our dynamic analysis confirmed that every time you navigate to any HTTP or HTTPS page, the PDF Editor extension sends the full URL of that page — encoded and linked to a permanent identifier unique to your install — to a third-party server at pass.work.ink. This server is operated by work.ink, linked to the extension developer's domain. The extension is a PDF editor; this behavior is not disclosed in the Chrome Web Store listing and has no visible connection to its advertised function. A planted marker value was transmitted to pass.work.ink, confirming the visited URL leaves the device. Our dynamic analysis confirmed that on every page you visit, the PDF Editor extension contacts a server at pass.work.ink and reads a JSON response that specifies where your browser should navigate next. When the server returns a redirect target with noRedirect set to false, the extension immediately changes the page you're on to any URL the server chooses — without asking you. The server currently returns noRedirect:true in responses we observed, but the redirect mechanism is fully operational. The destination URL is determined entirely by server-side logic and can be changed at any time, to any site, without any extension update.

Is PDF Editor safe?

Findings