Is PDF2DOCS safe?

Medium risk

PDF2DOCS is medium risk. The service worker collects a fingerprint, OS/browser version, a random UUID, and attribution tags, sending it to webinline-usage.streamesh.net on install and each new-tab open. streamesh.net is an ad network unnamed in the listing.…

pdf2docsconverterv1.4.2Chrome Web Store
49Risk
Who publishes it

pdf2docsconverter - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
pdf2docsconverter
Website
www.pdf2docs.com/contact.html

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

search.pdf2docs.com
Also called by 2 other listings, including SquarePage

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Device Fingerprint and Install-Source Data Sent to streamesh.net

The service worker collects a fingerprint, OS/browser version, a random UUID, and attribution tags, sending it to webinline-usage.streamesh.net on install and each new-tab open. streamesh.net is an ad network unnamed in the listing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab or the extension is installed for the first time.

The extension did this

The extension posts a JSON payload containing your device fingerprint and install-source attribution tags to https://webinline-usage.streamesh.net/.

The payload includes a persistent random install ID, a session UUID, OS name/version/bit-width, browser name and version, user-agent string, extension version, and UTC timestamp.

Fields transmitted to webinline-usage.streamesh.net
  • Install ID (EXT_UID)
    UN7382941650293847

    A 19-char random ID generated at install and stored in chrome.storage, tying future events to this install.

  • Session ID (ISID)
    a3f2e1b0-4c5d-4e6f-8a9b-0c1d2e3f4a5b

    A UUID generated per session and passed to the thank-you page, allowing the server to correlate the install event with search sessions.

  • Partner group ID (GID)
    SY1002486

    A hardcoded value (SY1002486) identifying the distribution partner or affiliate channel that delivered this installation.

  • OS name, version, and bit-width
    Windows NT 10.0 64Bit

    The operating system type (e.g. Windows NT), version number, and whether it is 32-bit or 64-bit.

  • Browser name and version
    Chrome 124

    The browser product name and major version number.

  • User-agent string
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

    The full navigator.userAgent string, which encodes browser, OS, and device details in a single value.

The code that does this

Service worker payload assembly (util.js:288)

Readable version
// Called on install; result stored in chrome.storage.local and POSTed to streamesh.net// utils.uId() = 19-char random string prefixed "UN"// utils.uUId() = RFC-4122-style UUID (time-seeded)// consts.USAGES_END_POINT = 'https://webinline-usage.streamesh.net/'
Destination domains
    • webinline-usage.streamesh.net

    Receives device fingerprint and install-source telemetry on install and on every new-tab open. Operated by a third-party distribution/monetization network.

    • i.pdf2docs.com

    Receives an 'Extension_Alive' heartbeat ping every 2 hours with the same device and version metadata (consts.ALIVE_END_POINT).

When this fires

On every browser startup

Transmits on every new-tab page load and also sends an 'Extension_Alive' heartbeat to i.pdf2docs.com at most once every 2 hours (interval: 7,200,000 ms).

Off-screen Affiliate Tracking Fields Injected into Every Search Form

The extension reads install-time partner IDs (GID, ISID, campaign tags N, M, L) and appends them as hidden inputs to search forms on its new-tab page and pdf2docs.com before submission, tying each search to the install channel, invisibly.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You type a search query and press Enter on the extension's new-tab page or on a pdf2docs.com page.

The extension did this

The extension appends off-screen form fields, including an affiliate group ID (gd), a session ID (isid), and campaign tags (n, m, l, d), to the search form before it is submitted.

These fields are not visible in the browser UI or in the final search URL displayed in the address bar.

Page DOM modified

Six non-displayed input fields containing affiliate attribution identifiers are appended to the form before submission.

Target
#searchForm on the new-tab page and on pdf2docs.com pages
Before
<form id="searchForm" action="https://www.pdf2docs.com/search">  <input type="text" name="q" value="convert pdf">  <button type="submit">Search</button></form>
After the extension changed it
<form id="searchForm" action="https://www.pdf2docs.com/search">  <input type="text" name="q" value="convert pdf">  <button type="submit">Search</button>  <input type="hidden" name="gd" value="SY1002486">  <input type="hidden" name="isid" value="a3f2e1b0-4c5d-4e6f-8a9b-0c1d2e3f4a5b">  <input type="hidden" name="n" value="ABC123">  <input type="hidden" name="m" value="search_install">  <input type="hidden" name="l" value="US">  <input type="hidden" name="d" value="2024-05-01"></form>
The code that does this

Off-screen input injection in beacon-script.js (content script on pdf2docs.com)

Readable version
// data = chrome.storage.local['extension.data'] (loaded at page ready)// map translates storage keys to HTML form field names// Appends one hidden <input> per key to #searchForm and #headerSearchForm// This runs on every page load matching https://*.pdf2docs.com/*
Off-screen fields appended to the search form
  • Affiliate group ID (gd)
    SY1002486

    Identifies the distribution partner or affiliate channel that supplied the extension installation. Hardcoded as SY1002486.

  • Session ID (isid)
    a3f2e1b0-4c5d-4e6f-8a9b-0c1d2e3f4a5b

    A UUID generated at install time that ties search sessions back to the original install event across visits.

  • Tracking tag N (n)
    ABC123

    An opaque campaign tracking string supplied by the installer's thank-you page.

  • Tracking tags M and L (m, l)
    search_install / US

    Additional opaque campaign or geo attribution values from the installer.

  • Install date (d)
    2024-05-01

    The UTC date of installation, allowing the server to calculate how long the extension has been installed.

What it can do

Permissions this extension asks for, as declared in version 1.4.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on pdf2docs.com

    https://*.pdf2docs.com/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

Updated 30 September 2026eoidebnenjkiaaojckmpiaolghkhbjdj