Is PDF-XChange safe?

Question

Accepted Answer

PDF-XChange is medium risk. When the PDF-XChange Chrome extension is installed alongside the PDF-XChange desktop application, any JavaScript on any webpage you visit — including third-party scripts — can send a browser message that causes the extension to issue an 'open by URL' command to the PDF-XChange desktop application with an attacker-chosen URL. Dynamic analysis confirmed the full relay: a test message sent from an unrelated origin passed through the extension's content script and service worker and was delivered to the native host (com.trackersoftware.htmltopdf) without any check on who sent the original message. The practical consequence depends on what the native application does with the command, which may include opening remote PDF documents or local file paths.

Is PDF-XChange safe?

Findings