Is PDF Generator safe?

Low risk

PDF Generator loads HTML from linangdata.com into its popup each time it opens and lets that content open new tabs.

Each time the popup opens, the extension requests content from linangdata.com and inserts it into the popup page without sanitising it. Links in that content can open any URL in a new browser tab, so the server decides which links and banners appear. The request carries a timestamp rather than a stable user ID.

LinangDatav1.0.2Chrome Web Store
20Risk
Who publishes it

LinangData - 18 other listings from the same operator, 4 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
LinangData
Website
linangdata.com/pdf-generator

Same store account

18 other listings published from this account, 236k+ users between them. 4 of them carry a finding.

Calculator90k+MediumGrammar40k+MediumExif Viewer40k+LowColor Picker20k+MediumPhoto Editor10k+MediumXML10k+Low12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

PDF Generator popup loads server-supplied HTML and links on every open

Code analysis shows the popup fetches HTML from linangdata.com on each open, inserts it unsanitised, and opens server-chosen links in new tabs when clicked.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open the PDF Generator popup from the toolbar.

The extension did this

The popup requests three pages from linangdata.com and inserts the replies into its own page as HTML.

The code that does this

Popup fetch and injection (app.js)

Readable version

Links panel and click handler

app.js
$.get( `https://linangdata.com/servedcontent/dynamiclinks.php?source=pdfGenerator&uuid=${uuid}`, function( data ) {    $( "#links" ).html( data );    $(".navopentab").unbind().on("click", function(e){      e.preventDefault();      var link = $(this).attr('href');      chrome.tabs.create({url:link});    })  });

Banners

app.js
$.get( `https://linangdata.com/servedcontent/bannertop.php?source=pdfGenerator&uuid=${uuid}`, function( data ) {    if (data) {      $( "#banner-top" ).html( data ).removeClass('hidden');    }  });  $.get( `https://linangdata.com/servedcontent/bannerbottom.php?source=pdfGenerator&uuid=${uuid}`, function( data ) {    if (data) {      $( "#banner-bottom" ).html( data ).removeClass('hidden');    }  });
What the popup sends and accepts
  • Request source tag
    source=pdfGenerator

    Identifies the extension to the server on each request.

  • Request timestamp
    uuid=1767225600000

    Current time in milliseconds; not a stable user identifier.

  • Links panel markup
    #links <- dynamiclinks.php response

    Server HTML written into the popup with no filtering.

  • Tab target
    href of .navopentab element

    Link address opened in a new tab is chosen by the server.

Remote host contacted by the popup
    • linangdata.com

    Serves links and banner HTML under /servedcontent/ for the popup.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Add items to the right-click menu

    contextMenus

Where it sends data

Destinations our analysis observed PDF Generator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • linangdata.comwidely used

    PDF Generator sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.

Updated 15 October 2026kkbhmbigddoacapidoknfldegagipkka