Is PDF Guru: PDF Converter & Editor Extension for Chrome safe?

Medium risk

PDF Guru is medium risk. Opening any PDF, on any website, redirects your browser to viewer.pdfguru.com with no click, with the original PDF's URL attached. We reproduced this with a real third-party PDF.…

dmytro.kanievskyiv1.1.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

PDF Guru redirects every PDF you open to its own viewer.pdfguru.com

Opening any PDF, on any website, redirects your browser to viewer.pdfguru.com with no click, with the original PDF's URL attached.

We reproduced this with a real third-party PDF.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click a link to, or type the address of, a PDF hosted on any website.

For example, a PDF linked from a search result or a document you were emailed.

The extension did this

The tab is redirected to viewer.pdfguru.com before the PDF loads, with the original URL attached.

PDF Guru's own viewer then renders the file with its editing toolbar on top.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://viewer.pdfguru.com/?file=https://www.orimi.com/pdf-test.pdf&pg_src=ce
HTTP 200. The tab's top-level location changed to this URL with no user click; PDF Guru's viewer then rendered the source PDF with its own toolbar overlaid.
03EvidenceCODE COMPARE
The code that does this

The webRequest listener that fires on every PDF response, on every site

What it actually does
chrome.webRequest.onHeadersReceived.addListener(
  function (details) {
    var isPdfResponse = details.responseHeaders?.some(function (h) {
      return h.name.toLowerCase() === "content-type" &&
        h.value?.toLowerCase().includes("application/pdf");
    });
    if (!alreadyRedirected(details.url) && !recentlyHandled(details.tabId) && isPdfResponse) {
      recentlyHandledTabs.set(details.tabId, Date.now());
      var redirectUrl = "https://viewer.pdfguru.com?file="
        + encodeURIComponent(details.url) + "&pg_src=ce";
      chrome.tabs.update(details.tabId, { url: redirectUrl });
    }
  },
  { urls: ["<all_urls>"], types: ["main_frame"] },
  ["responseHeaders"]
);
04EvidenceCODE COMPARE
The code that does this

The declarativeNetRequest rule installed on every browser startup

What it actually does
function registerRedirectRules() {
  return __awaiter(this, void 0, void 0, function () {
    var existingRules, existingIds;
    return __generator(this, function (step) {
      switch (step.label) {
        case 0:
          return [4, chrome.declarativeNetRequest.getDynamicRules()];
        case 1:
          existingRules = step.sent();
          existingIds = existingRules.map(function (r) { return r.id; });
          return [4, chrome.declarativeNetRequest.updateDynamicRules({
            removeRuleIds: existingIds,
            addRules: [
              // Rule 1: don't re-redirect a URL we already redirected
              { id: 1, priority: 2,
                condition: { regexFilter: "pg_bypass=1|pg_src=ce",
                  resourceTypes: ["main_frame"] },
                action: { type: "allow" } },
              // Rule 2: any .pdf URL, on ANY site, gets rewritten to
              // viewer.pdfguru.com with the original URL attached
              { id: 2, priority: 1,
                condition: { regexFilter: "^https?://[^?#]*/[^?#/]*\\.pdf(\\?[^#]*)?$",
                  resourceTypes: ["main_frame"] },
                action: { type: "redirect",
                  redirect: { regexSubstitution: "https://viewer.pdfguru.com?file=\\0&pg_src=ce" } } }
            ]
          })];
        case 2:
          step.sent();
          return [2];
      }
    });
  });
}
05EvidenceTHIRD PARTY LIST
Where the PDF's URL ends up
  • viewer.pdfguru.com

    PDF Guru's own hosted viewer. Receives the full URL of every PDF you open, on every website, as a query parameter.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

PDF Guru sends your local file path to viewer.pdfguru.com

Opening a PDF stored on your own computer redirects the tab to viewer.pdfguru.com with the full file:// path URL-encoded in the address.

We reproduced this with a real local file.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a PDF stored on your own computer directly in Chrome, using a file:// address.

This requires the extension's optional "Allow access to file URLs" setting to be on.

The extension did this

The tab is redirected to viewer.pdfguru.com with your full local file path attached as a query parameter.

PDF Guru's own viewer then renders the file, having received the on-disk path and filename.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://viewer.pdfguru.com/?file=file%3A%2F%2F%2FUsers%2Fjsmith%2FDownloads%2Finvoice.pdf&pg_src=ce
The browser navigated to this URL with no click, carrying the local file's full path and filename URL-encoded in the file= parameter. (illustrative path; a planted local test file was used to confirm this during dynamic analysis)
03EvidenceCODE COMPARE
The code that does this

The listener that matches any local PDF file you open

What it actually does
chrome.webRequest.onBeforeRequest.addListener(
  function (details) {
    var isPdfPath = details.url.split("?")[0].toLowerCase().endsWith(".pdf");
    if (!alreadyRedirected(details.url) && !recentlyHandled(details.tabId) && isPdfPath) {
      recentlyHandledTabs.set(details.tabId, Date.now());
      var redirectUrl = "https://viewer.pdfguru.com?file="
        + encodeURIComponent(details.url) + "&pg_src=ce";
      chrome.tabs.update(details.tabId, { url: redirectUrl });
    }
  },
  { urls: ["file:///*"], types: ["main_frame"] }
);
04EvidenceFIELD TABLE
What leaves your device when you open a local PDF
FieldValueWhy it matters
Local file path and filename
file:///Users/jsmith/Downloads/invoice.pdf (illustrative)Everything after file:// is sent, including folders that may contain your username.
05EvidenceTHIRD PARTY LIST
Where the local file path ends up
  • viewer.pdfguru.com

    PDF Guru's own hosted viewer. Receives the full local file:// path, including folder names, of any local PDF you open.

Updated 17 September 2026lpkcmidikofadbndkgenjamfhlpmncnk