This PDF Chrome extension might contain malware

This post has been updated. It was originally published on June 1, 2023.

An independent security researcher has found malicious code in 18 Chrome extensions currently available in the Chrome Web Store. Combined, the extensions have over 57 million active users. It’s yet more evidence that Chrome extensions need to be evaluated with a critical eye. 

Chrome extensions are apps built on top of Google Chrome that allow you to add extra features to your browser. The tasks that this customizable feature can do are wide-ranging, but some popular extensions can auto-fill your password, block ads, enable one-click access to your todo list, or change how a social media site looks. Unfortunately, because Chrome extensions are so powerful and can have a lot of control over your browsing experience, they are a popular target for hackers and other bad actors. 

Earlier this month, independent security researcher Wladimir Palant discovered code in a browser extension called PDF Toolbox that allows it to inject malicious JavaScript code into any website you visit. The extension purports to be a basic PDF processor that can do things like convert other documents to PDF, merge two PDFs into one, and download PDFs from open tabs. 

It’s that last feature that leaves PDF Toolbox open for bad intentions. Google requires extension developers to only use the minimum permissions necessary. In order to download PDFs from tabs that aren’t currently active, PDF Toolbox has to be able to access every web page you currently have open. Without this feature, it would not be able to pseudo-legitimately access your browser to the same extent.

While PDF Toolbox seemingly can do all the PDF tasks it claims to be able to, it also downloads and runs a JavaScript file from an external website which could contain code to do almost anything, including capture everything you type into your browser, redirect you to fake websites, and take control of what you see on the web. By making the malicious code resemble a legitimate API call, obfuscating it so that it’s hard to follow, and delaying the malicious call for 24 hours, PDF Toolbox has been able to avoid being removed from the Chrome Web Store by Google since it was last updated in January 2022. (It is still available there at the time of writing, despite Palant lodging a report about its malicious code.) 

Palant had no way of confirming what the malicious code in PDF Toolbox did when he first discovered it. However yesterday, he disclosed 17 more browser extensions that use the same trick to download and run a JavaScript file. These include Autoskip for Youtube, Crystal Ad block, Brisk VPN, Clipboard Helper, Maxi Refresher, Quick Translation, Easyview Reader view, Zoom Plus, Base Image Downloader, Clickish fun cursors, Maximum Color Changer for Youtube, Readl Reader mode, Image download center, Font Customizer, Easy Undo Closed Tabs, OneCleaner, and Repeat button, though it is likely that there are other infected extensions. These were only the ones that Palant found in a sample of approximately 1,000 extensions.

In addition to finding more affected extensions, Palant was able to confirm what the malicious code was doing (or at least had done in the past). The extensions were redirecting users’ Google searches to third-party search engines, likely in return for a small affiliate fee. By infecting millions of users, the developers could rake in a tidy amount of profit. 

Unfortunately, code injection is code injection. Just because the malicious JavaScript fairly harmlessly redirected Google searches to alternative search engines in the past, doesn’t mean that it does so today. “There are way more dangerous things one can do with the power to inject arbitrary JavaScript code into each and every website,” writes Palant.

And what kind of dangerous things are those? Well, the extensions could be collecting browser data, adding extra ads to every web page someone visits, or even recording online banking credentials and credit card numbers. Malicious JavaScript running unchecked in your web browser can be incredibly powerful. 

If you have one of the affected extensions installed on your computer, you should remove it now. It’s also a good idea to do a quick audit of all the other extensions you have installed to make sure that you are still using them, and that they all look to be legitimate. If you not, you should remove them too. 

Otherwise, treat this as a reminder to always be vigilant for potential malware. For more tips on how to fight it, check out our guide on removing malware from your computer.

Update on June 2, 2023. A Google spokesperson said: “The Chrome Web Store has policies in place to keep users safe that all developers must adhere to. We take security and privacy claims against extensions seriously, and when we find extensions that violate our policies, we take appropriate action. These reported extensions have been removed from the Chrome Web Store.”

Free PDF editing software can hide malware – Try this trustworthy option

Plenty of free browser-based solutions exist, but these convenient tools don’t always live up to the industry’s best. Of course, we’re talking about Adobe Acrobat Pro, Photoshop and others that come at a steep premium.

Great PDF software doesn’t have to be super fancy. We love a job well done, with few errors and easy delivery, download, share or publish options. Tap or click here to see some of our other favorite PDF tools online.

ILovePDF is one do-it-all PDF tool that can take care of pretty much any PDF-related task on your plate. Read on, never to find yourself messing around with an expired Acrobat subscription again.

ILovePDF is much more than just a browser-based PDF editor. You can download the app for your desktop or phone.

To use ILovePDF, all you have to do is visit the site. On its homepage, you’ll see many options, which will likely be familiar to anybody who frequently works with PDF documents. This PDF web app enables you to do all of the following and more:

If you’ve been stuck with these tasks without the right PDF software to carry them out, this website will almost certainly be a sight for sore eyes. Things like text replacement, annotations, highlighting and even adding new media to a PDF now take no time.

ILovePDF makes these simple tools easy to use and readily available from any device. Only one question remains: what happens to your document after you finish?

When finished editing a PDF, hit the big Export PDF button at the bottom. The site will generate your new document, and you can download it to your computer directly if desired.

After finalizing edits, you can compress the PDF, merge it with another, protect it, split it, convert it, or add your final watermark.

Other handy options include sharing a QR code or a Google Docs-style sharing link, saving it to your Dropbox account and adding it to your Google Drive. You may also share it with any social media network, including Facebook, Twitter or LinkedIn. 

These protected documents can often be a hiccup in one’s productivity pipeline. Thankfully, with tools like ILovePDF in your back pocket, you’ll never be locked out of something important again.

You may also like: A safe way to sign PDFs and convert them to different formats

Delete these 32 Google Chrome extensions that pose a security threat

Google removed 32 extensions from Chrome after cyber security researchers discovered their malicious intent. According to cybersecurity firm Avast and researcher Wladimir Palant, most of these Chrome extensions offered legitimate functionality but injected arbitrary code into any website a user visited. Due to this, users were infected with ads on web pages and manipulated search results. The extensions do not redirect users to phishing websites, although the exact purpose remains unclear. Therefore, it is better to remove them if users have them installed. Security researchers claim these 32 extensions have more than seven crores of downloads, though the numbers seem inflated as reviews on the Chrome Web Store are suspiciously low.

In a blog post, Avast highlights that the functionalities of these Chrome extensions ranged from ad blockers, downloaders and browser themes to recorders and tab managers. These Chrome extensions probably stayed under the radar as they offered legitimate functionality. However, cybersecurity researcher Palant began investigating the PDF Toolbox extension in May and found that websites were injected with "arbitrary JavaScript code." In a separate post, he said that the goal of this code was to monetize the browser extension in ways prohibited by Chrome Web Store policies.

Days later, the researcher found similar code in more than 20 Chrome extensions. At the end of May, Avast, thanks to initial research by Palant, discovered 32 malicious extensions in the Chrome web store. Some of them include Autoskip for Youtube (9 million), Soundboost (6.9 million), Crystal Ad Block (6.8 million), Brisk VPN (5.6 million), Clipboard Helper (3.5 million), and Maxi Refresher (3.5 million).

Avast's investigation continues and warns users not to download extensions from suspicious developers. The post says, "This example is a reminder that individuals must use caution when installing extensions – even those available on official platforms like the Chrome Web Store. A rule of thumb: Always check the developer's reputation and read reviews before installing an extension. Also, be wary of extensions that request excessive permissions or seem to have unrelated functionalities."

The company promises greater security with its antivirus software. The security researcher adds that these extensions mainly made money by redirecting search pages, though they still need to be expanded to that now.