Is PDF to text safe?

Medium risk

PDF to text lets its vocabulary.live iframe request the active page URL, title, selected text, DOM content, and localStorage.

When the browser action opens the PDF to text sidebar, the extension injects a page script that accepts messages from the vocabulary.live iframe. That iframe can request the active tab's URL and title, receive selected text, read matching page text or HTML, and read named localStorage values.

Prius Labv1.2.1Chrome Web Store
45Risk
Who publishes it

Prius Lab - 3 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Prius Lab
Declared legal entity
Prius Lab
Registered address
Robocha st 10a 3, Shostka, Сумська область 41106, UA
Registered contact
Vitalii Doroshenko
Website
pdftotext.top/support

Same store account

3 other listings published from this account, 22k+ users between them. 2 of them carry a finding.

Youtube to Transcript20k+CleanPrompt Generator1k+HighVocabulary builder579Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Vocabulary.live iframe can request active page data after toolbar click

Clicking the PDF to text button opens a vocabulary.live iframe in the active tab.

That iframe can ask the extension bridge for the page URL and title, selected text, page DOM text or HTML, and localStorage values.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

The user clicks the extension browser action.

The extension did this

The extension opens a vocabulary.live iframe that can request active-page URL, title, DOM content, and localStorage values through a page bridge.

Captured request
GEThttps://vocabulary.live/pdf-to-text
Fields available to the iframe bridge
  • Current page URL
    https://example.com/article (illustrative)

    Shows which page is open in the active tab when the bridge is used.

  • Current page title
    Example Article Title (illustrative)

    Adds readable context about the page being viewed.

  • Page DOM content
    Article paragraph text (illustrative)

    Can include visible text or HTML selected by a requested page selector.

  • Page localStorage value
    user-preference-value (illustrative)

    Can expose values stored by the current site under requested localStorage keys.

Where it sends data

Destinations our analysis observed PDF to text contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • vocabulary.live

    PDF to text sends data to vocabulary.live. 3 other extensions we have analysed send data here.

Updated 30 September 2026ebbjjgknalnhiikophnjodoenamanonj