Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: FormSwift PDF Editor:Convert, Sign, Edit

CRITICAL RISKRemoved from Chrome Web Store

FormSwift PDF Editor:Convert, Sign, Edit

ID: bdfcnmeidppjeaggnmidamkiddifkdib

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.5

Size

5.75 MB

Rating

1.4/5

Reviews

709

Users

300,000

Type

Extension

Updated

Jan 9, 2025

Publisher Contextual Analysis

Author: https://formswift.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

300,000

Email Change History

1 change

Jun 20, 2024

Domain changed

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Edit, sign, and convert PDFs from Gmail or the web.

Save time by adding FormSwift to Chrome. Instantly upload and edit any PDF directly from your browser or wherever you are on the web with just one click. ★ PDF Editor Features: ▸ Edit PDF Use our PDF editor to fill out your document, add, remove, & highlight text, upload images, your logo, checkmarks, and more. No additional installation needed. ▸ Sign Electronically Legally sign any PDF in seconds, request signatures from others, and be notified once your document has been signed. ▸ Convert PDF Convert your document into an editable file. Go from PDF to Word, Word to PDF, image (JPEG, PNG) to PDF. ★ How the Extension Works: ▸ Upload Upload a PDF to edit at any time—without going to another page—by clicking on the FormSwift button in the top right corner of your screen. ▸ Gmail Easily edit or sign any PDF sent to your Gmail. Hover over the PDF attachment click the “Edit” button to instantly start editing. ▸ Web Quickly edit or sign any PDF from the web. Hover next to a PDF from search engine results and use the custom buttons that appear to edit or sign any PDF.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 591 ratings+1 (0%)

Average Rating

Current: 1.49 / 5.0-0.12

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High6

Medium6

Low1

Versions scanned

Showing 2 of 12 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	6
0.101 Code review	7

Extension Version	Code Review Findings
1.0	6
0.101	7

Files with findings

5 distinct paths — top paths by unique finding count:

bg.js7
manifest.json2
rules.json2
add-formswift-gmail-button.js1
show-formswift-dialog.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	bg.js (line 17)	The external message listener calls `chrome.scripting.executeScript(null, ...)` passing `null` as the injection target — an invalid API call in Manifest V3 where the first argument must be an `InjectionTarget` object.…	0.101
2	Data Exfiltration	high	bg.js (line 193)	This code downloads a Gmail attachment from its message URL and then uploads the raw file contents to a FormSwift endpoint. In context with the Gmail content script, the extension can extract email attachments and tra…	1.0
3	Data Exfiltration	high	bg.js (line 66)	The background service worker silently downloads Gmail attachment files (PDFs and DOCX) using the attachment's private Google-signed download URL, then immediately re-uploads the full binary content to FormSwift's API…	0.101
4	Data Exfiltration	high	bg.js (line 107)	Any PDF URL found on any web page (including authenticated, behind-login URLs) is sent to FormSwift's `importPdfFromUrl.php` API. The FormSwift server then fetches the document from that URL server-side, meaning priva…	0.101
5	Network Interception	high	rules.json (line 1)	The extension uses declarativeNetRequest to force the `access-control-allow-origin` response header to `*` (wildcard) on formswift.com's `importPdfFromUrl.php` endpoint. This deliberately bypasses the browser's same-o…	0.101
6	Remote Code Loading	high	manifest.json (line 34)	The manifest grants the extension both `<all_urls>` content-script reach and an extension-page CSP that explicitly allows scripts from `https://formswift.com`. Allowing remotely hosted script on privileged extension p…	1.0
7	Code Injection	medium	show-formswift-dialog.js (line 31)	The `postMessage` event listener does not validate `e.origin` before acting on incoming messages. Any page in the browser can post a message with arbitrary `eventName` and `data` values to control the extension's inje…	0.101
8	Credential Theft	medium	manifest.json (line 72)	A Google API key (`AIzaSy...`) is hard-coded in the publicly distributed manifest. The declared OAuth2 scopes include `drive.appdata` and `drive.file`, granting access to the user's Google Drive. Any party who extract…	0.101
9	Data Exfiltration	medium	bg.js (line 237)	The extension posts arbitrary PDF URLs to a remote FormSwift API for server-side import. Because the content script is injected on `<all_urls>` and scans pages for PDF links, this allows off-site export of documents a…	1.0
10	Tracking	medium	bg.js (line 107)	This sends analytics events to Mixpanel with a persistent `distinct_id`. Elsewhere in the same listener flow, that ID is populated from the `userid` cookie for `formswift.com`, linking extension activity to a site acc…	1.0
11	Tracking	medium	bg.js (line 75)	The background script reads the `formswift.com` Google Analytics cookie and reuses it as the client identifier for extension telemetry. This is a cross-context tracking pattern that correlates browser-extension behavi…	1.0
12	Unauthorized Data Collection	medium	add-formswift-gmail-button.js (line 7)	The content script scrapes Gmail's private internal DOM attribute `[download_url]` to extract attachment names, MIME types, and authenticated Google download URLs for all email attachments. This polling runs every 700…	0.101
13	Network Interception	low	rules.json (line 1)	The declarativeNetRequest ruleset rewrites response headers for a FormSwift API endpoint to force `Access-Control-Allow-Origin: *`. This is a network-manipulation pattern that relaxes browser origin protections around…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

178

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


formswift.com	/sem/edit-pdf	https://formswift.com/sem/edit-pdf
formswift.com	/extension/uninstalled	https://formswift.com/extension/uninstalled?utm_source=chrome-extension-uninstalled
formswift.com	-	https://formswift.com
www.indiehackers.com	/post/how-to-add-google-analytics-with-manifest-v3-468f1750dc	https://www.indiehackers.com/post/how-to-add-google-analytics-with-manifest-v3-468f1750dc
www.google-analytics.com	/collect	https://www.google-analytics.com/collect
github.com	/ai/nanoid	https://github.com/ai/nanoid
developer.mixpanel.com	/reference/track-event	https://developer.mixpanel.com/reference/track-event
api.mixpanel.com	/track	https://api.mixpanel.com/track?ip=1&verbose=1
loc.formswift.com	-	http://loc.formswift.com:8888/
formswift.com	-	https://formswift.com/

Showing 1 to 10 of 180 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


12.3.2.2	IPv4	-
7.6.3.2	IPv4	-
12.6.4.7	IPv4	-
12.5.6.10	IPv4	-
12.7.3.3	IPv4	-
12.5.6.13	IPv4	-
9.6.6.1	IPv4	-
9.7.6.2	IPv4	-
6.2.5.7	IPv4	-
6.5.8.2	IPv4	-
7.4.3.1	IPv4	-
6.4.11.3	IPv4	-
6.4.11.4	IPv4	-
6.5.8.1	IPv4	-
6.4.11.1	IPv4	-
6.4.11.2	IPv4	-
6.6.5.2	IPv4	-
7.4.2.1	IPv4	-
9.6.6.4	IPv4	-
9.6.6.2	IPv4	-
8.7.3.1	IPv4	-

Showing 1 to 21 of 30 rows

Rows per page:

1.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

broken. on three different devices, it says Please enable the extension to view files by toggling "Allow access to file URLs" when it is already toggled rest in peace

armon·2 Nov 2024

"Free" is a JOKE. Should have read the reviews. DELETE.

Toni Sabel·25 Sept 2024

Asked to set up a free trial in order to download a document.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

FormSwift PDF Editor:Convert, Sign, Edit

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 12 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating