Is Save Website as PDF safe?

Medium risk

Save Website as PDF sends Google Analytics events when users generate PDFs and interact with the popup.

The extension creates or reuses a local Google Analytics client ID and posts event data to Google Analytics for PDF generation and popup interactions. Those events include the client ID, event name and parameters, extension version, and engagement timing, even though its bundled privacy text says there is no tracking or analytics.

web2pdf.saverv1.4.0Chrome Web Store
48Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends Google Analytics events after PDF and popup actions

Save Website as PDF sends Google Analytics events to www.google-analytics.com, including a persistent client ID plus event details like PDF generation or popup interaction, despite the bundled privacy text claiming no tracking.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user generates a PDF or uses popup controls.

The extension did this

The extension sends Google Analytics events containing a persistent local storage client ID and event parameters.

Captured request
POSTwww.google-analytics.com/mp/collect?measurement_id=G-EEE73CDNGN
Fields in the request
  • Local analytics client ID
    d7f3a1b2-9c4e-4a3d-8b75-1a2b3c4d5e6f (illustrative)

    A persistent identifier stored by the extension can link multiple analytics events from the same browser profile.

Observation

The database evidence also records bundled privacy text stating there is no tracking or analytics, while dynamic analysis confirmed the analytics request path.

What it can do

Permissions this extension asks for, as declared in version 1.4.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Start, monitor and manage your downloads

    downloads

  • Run its own code inside the pages you visit

    scripting

  • Attach to pages with the browser's debugger, which can read and rewrite anything on them

    debugger

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Save Website as PDF contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Save Website as PDF sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026ihgncekibldpfkefpchbcdmifodkfhpm