Is Search by ViewPDF safe?
Search by ViewPDF sets hviewpdf.com as the default search engine and sends ad-tracking data from browsing history to viewpdf.com on install.
When installed, the extension overrides the browser's default search engine with hviewpdf.com, contradicting its description which states it updates the search provider to Yahoo. On first install, it reads the most recent Chrome Web Store page from the user's browsing history to extract ad-tracking parameters (affiliate source, Google Click ID) and transmits them to viewpdf.com by opening a new tab. All subsequent searches typed into the address bar are routed through hviewpdf.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Default search routes through hviewpdf.com, a Yahoo affiliate gateway
The manifest sets omnibox default search to hviewpdf.com, not Yahoo, though the store description claims it updates search to Yahoo.
A query to hviewpdf.com/search/?q=<term> 302s to uk.search.yahoo.com/yhs/search, hspart=dcola/hsimp=yhs089.
You type a search into the Chrome address bar and press enter.
After install, this extension is the default search provider, so the omnibox routes the query through it.
The query is sent to hviewpdf.com, a third-party domain.
The destination is hviewpdf.com/search/, not Yahoo as the store listing states.
The manifest declares hviewpdf.com as the default search, while the listing says Yahoo
// Default search target declared in the manifest:
// https://hviewpdf.com/search/?q={searchTerms}
// The {searchTerms} placeholder is replaced with the user's query.
// The host is hviewpdf.com, a third party — not search.yahoo.com.- hviewpdf.com
Receives every omnibox query first as the declared default search provider; redirects to Yahoo's yhs gateway.
- uk.search.yahoo.com
Yahoo syndicated-search (yhs) endpoint reached only after the hviewpdf.com redirect, carrying affiliate parameters hspart=dcola, hsimp=yhs-089.
The store description states the extension 'updates your default search provider to Yahoo.' The manifest sets the default search to hviewpdf.com, a third-party domain. Yahoo results are returned only after hviewpdf.com receives the query and issues a redirect, so the listing's description does not match the configured search destination.
On install, reads browsing history for ad-referral params and opens viewpdf.com
On install, onInstalled runs chrome.history.search for the last Web Store visit, parsing ad params (ssg, sp, gclid) to open viewpdf.com with them.
The 'history' permission is missing, so it falls back to viewpdf.com?ssg=00&sp=bing&gclid=x.
You install the extension for the first time.
The onInstalled handler only runs when reason === 'install', so this is first-install behavior.
The extension reads browsing history for Web Store referral parameters and opens a tab to viewpdf.com.
It looks up the most recent chrome.google.com/webstore/detail/ URL and forwards its ssg, sp and gclid values.
The install handler reads history, parses ad parameters, and navigates to viewpdf.com
// On first install only: // 1. Search browsing history for the most recent Chrome Web Store // detail page the user visited. // 2. Pull its ad-referral query params: ssg, sp (source), gclid (Google // Click ID set by Google Ads). // 3. Open viewpdf.com/ds/success?ssg=..&sp=..&gclid=.. carrying them. // 4. If the history read fails (no 'history' permission, or no page), // fall back to hardcoded ssg=00&sp=bing&gclid=blank.
| Field | Value | Why it matters | |
|---|---|---|---|
Ad source group (ssg) | 00 | An advertising source-group identifier carried on the install referral link. | |
Source (sp) | bing | The marketing source/channel that drove the install. | |
Google Click ID (gclid) | blank | A Google Ads click identifier that ties the install back to a specific ad click and campaign. |
ds=<base64 page-view payload encoding {type:pageview, visit_uuid, pageview_id}>During dynamic analysis the install opened a tab to https://www.viewpdf.com/?ssg=00&sp=bing&gclid=blank — the hardcoded fallback values — because the manifest declares no 'history' permission and the chrome.history.search call rejected. The code path that reads browsing history and forwards real referral parameters to viewpdf.com is present and would run if the permission were granted; as shipped it does not complete the history read.