Easy PDF Viewer Search Hijack and Persistent Tracking

Overview

Easy PDF Viewer (Chrome extension ID jgdddeonphekfhicmnpffkfpboalmcjd) is a PDF viewer that silently hijacks the browser's default search engine and tracks users with a persistent cookie. The extension forces all searches through easypdfviewer.net, a domain controlled by the operator, and plants a 5-year tracking cookie (uid) that respawns if deleted. This behavior is not disclosed in the extension's description and goes beyond what users expect from a PDF viewer.

How it works

On installation, the extension's background script (src/js/background.js) sends a beacon to https://easypdfviewer.net/admin/public/install (line 29) and opens a landing page at https://easypdfviewer.net/success-search (line 24). The manifest (manifest.json:33) declares a chrome_settings_overrides that sets the default search provider to https://easypdfviewer.net/admin/public/link?q={searchTerms} with is_default: true. This overrides the user's existing search engine without explicit consent.

Payload

Beyond the search hijack, the extension establishes persistent tracking:

• It sets a cookie named uid on easypdfviewer.net with a 5-year expiration (COOKIE_MAX_AGE_SEC in line 4).
• It listens for cookie changes (chrome.cookies.onChanged) and, if the uid cookie is removed, re-creates it (line 58), making it difficult for users to clear tracking.
• It sets an uninstall URL to https://easypdfviewer.net/admin/public/feedback (line 36), allowing the operator to track removals.

Store status

As of this analysis, the extension is still live on the Chrome Web Store with approximately 50,000 installs. The sandbox reproduced the search provider override, confirming the behavior in version 1.0.0.0. Users should remove the extension and clear cookies for easypdfviewer.net to stop the tracking.