Is Qwer PDF safe?

Qwer PDF forwards all postMessage events from any web page to its service worker without validating the sender's origin.

The extension's content script runs on every web page and listens for postMessage events. The origin check that would restrict messages to qwerpdf.com is commented out, so any page can trigger service worker actions including file uploads to qwerpdf.com servers and overwriting stored user credentials.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.