Is pdfFiller safe?

Question

Is pdfFiller safe?

Accepted Answer

pdfFiller is high risk. Our dynamic analysis confirmed: when you click the extension's button to open a PDF, the extension sends the PDF's full URL (or its base64-encoded file contents if it's a local file) to pdffiller.com's servers. This occurs for any PDF you encounter across all websites, because the extension injects its button into every page via an all-URLs content script running at document_start. The POST request goes to https://www.pdffiller.com/flash/data/up.php and pdffiller.com returns a redirect URL to their editor — meaning the PDF content is processed on their servers before you see the editor. The Chrome Web Store listing does not disclose that PDF files are uploaded to pdffiller.com as a prerequisite to opening the editor. Our dynamic analysis confirmed: when you click a PDF attachment in Gmail, the extension reads the sender's email address and the email subject line directly from the Gmail page's DOM and includes both in the upload request to pdffiller.com. The POST body to https://www.pdffiller.com/flash/data/up.php contains the attachment's base64-encoded file contents along with the sender's email address (type=GMAIL, from=..., subject=...). This means the contents of the PDF attachment, who sent it to you, and the subject of the email are all transmitted to pdffiller.com. The Chrome Web Store listing does not disclose that email metadata is collected when using the extension with Gmail.

Is PDF Editor for Chrome:Edit, Fill, Sign, Print safe?

Findings