Am I Being Pwned?
Get started

Is PDF Guru: PDF Converter & Editor Extension for Chrome safe?

Medium risk

PDF Guru is medium risk. Opening any PDF, on any website, redirects your browser to viewer.pdfguru.com with no click, with the original PDF's URL attached. We reproduced this with a real third-party PDF.…

dmytro.kanievskyiv1.3.0Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

PDF Guru redirects every PDF you open to its own viewer.pdfguru.com

MediumunwantedCWE-200Dynamic sandbox

Opening any PDF, on any website, redirects your browser to viewer.pdfguru.com with no click, with the original PDF's URL attached.

What actually happens

You did this

You click a link to, or type the address of, a PDF hosted on any website.

For example, a PDF linked from a search result or a document you were emailed.

The extension did this

The tab is redirected to viewer.pdfguru.com before the PDF loads, with the original URL attached.

PDF Guru's own viewer then renders the file with its editing toolbar on top.

Captured request

GEThttps://viewer.pdfguru.com/?file=https://www.orimi.com/pdf-test.pdf&pg_src=ce

HTTP 200. The tab's top-level location changed to this URL with no user click; PDF Guru's viewer then rendered the source PDF with its own toolbar overlaid.

The code that does this

The webRequest listener that fires on every PDF response, on every site

Readable version
chrome.webRequest.onHeadersReceived.addListener(  function (details) {    var isPdfResponse = details.responseHeaders?.some(function (h) {      return h.name.toLowerCase() === "content-type" &&        h.value?.toLowerCase().includes("application/pdf");    });    if (!alreadyRedirected(details.url) && !recentlyHandled(details.tabId) && isPdfResponse) {      recentlyHandledTabs.set(details.tabId, Date.now());      var redirectUrl = "https://viewer.pdfguru.com?file="        + encodeURIComponent(details.url) + "&pg_src=ce";      chrome.tabs.update(details.tabId, { url: redirectUrl });    }  },  { urls: ["<all_urls>"], types: ["main_frame"] },  ["responseHeaders"]);

The code that does this

The declarativeNetRequest rule installed on every browser startup

Readable version
function registerRedirectRules() {  return __awaiter(this, void 0, void 0, function () {    var existingRules, existingIds;    return __generator(this, function (step) {      switch (step.label) {        case 0:          return [4, chrome.declarativeNetRequest.getDynamicRules()];        case 1:          existingRules = step.sent();          existingIds = existingRules.map(function (r) { return r.id; });          return [4, chrome.declarativeNetRequest.updateDynamicRules({            removeRuleIds: existingIds,            addRules: [              // Rule 1: don't re-redirect a URL we already redirected              { id: 1, priority: 2,                condition: { regexFilter: "pg_bypass=1|pg_src=ce",                  resourceTypes: ["main_frame"] },                action: { type: "allow" } },              // Rule 2: any .pdf URL, on ANY site, gets rewritten to              // viewer.pdfguru.com with the original URL attached              { id: 2, priority: 1,                condition: { regexFilter: "^https?://[^?#]*/[^?#/]*\\.pdf(\\?[^#]*)?$",                  resourceTypes: ["main_frame"] },                action: { type: "redirect",                  redirect: { regexSubstitution: "https://viewer.pdfguru.com?file=\\0&pg_src=ce" } } }            ]          })];        case 2:          step.sent();          return [2];      }    });  });}

Where the PDF's URL ends up

    • viewer.pdfguru.com

    PDF Guru's own hosted viewer. Receives the full URL of every PDF you open, on every website, as a query parameter.

PDF Guru sends your local file path to viewer.pdfguru.com

MediumunwantedCWE-200Dynamic sandbox

Opening a PDF stored on your own computer redirects the tab to viewer.pdfguru.com with the full file:// path URL-encoded in the address.

What actually happens

You did this

You open a PDF stored on your own computer directly in Chrome, using a file:// address.

This requires the extension's optional "Allow access to file URLs" setting to be on.

The extension did this

The tab is redirected to viewer.pdfguru.com with your full local file path attached as a query parameter.

PDF Guru's own viewer then renders the file, having received the on-disk path and filename.

Captured request

GEThttps://viewer.pdfguru.com/?file=file%3A%2F%2F%2FUsers%2Fjsmith%2FDownloads%2Finvoice.pdf&pg_src=ce

The browser navigated to this URL with no click, carrying the local file's full path and filename URL-encoded in the file= parameter. (illustrative path; a planted local test file was used to confirm this during dynamic analysis)

The code that does this

The listener that matches any local PDF file you open

Readable version
chrome.webRequest.onBeforeRequest.addListener(  function (details) {    var isPdfPath = details.url.split("?")[0].toLowerCase().endsWith(".pdf");    if (!alreadyRedirected(details.url) && !recentlyHandled(details.tabId) && isPdfPath) {      recentlyHandledTabs.set(details.tabId, Date.now());      var redirectUrl = "https://viewer.pdfguru.com?file="        + encodeURIComponent(details.url) + "&pg_src=ce";      chrome.tabs.update(details.tabId, { url: redirectUrl });    }  },  { urls: ["file:///*"], types: ["main_frame"] });

What leaves your device when you open a local PDF

  • Local file path and filename
    file:///Users/jsmith/Downloads/invoice.pdf (illustrative)

    Everything after file:// is sent, including folders that may contain your username.

Where the local file path ends up

    • viewer.pdfguru.com

    PDF Guru's own hosted viewer. Receives the full local file:// path, including folder names, of any local PDF you open.

Updated 30 September 2026lpkcmidikofadbndkgenjamfhlpmncnk