What our analysis found

Foxit PDF Creator, used by 7,000,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. It comes from a trusted publisher and was last updated in July 2026.

Key findings

• high· other —The bundled manifest explicitly declares manifest_version 2, whereas the published CWS summary lists manifest_version 3. This version discrepancy could indicate an outdated or unreleased update, or an error in the store listing. It does not necessarily indicate malicious intent.

The extension's code only communicates with a native host via nativeMessaging to convert web pages to PDF, with no remote network requests. Cookie access is required to forward session data to the native app. No data exfiltration or tracking to third parties was found. The published manifest version (MV3) differs from the bundled (MV2), but this is a benign discrepancy. The ML model's triggering patterns (base64 encoding, executeScript) are typical for this type of extension and are either disabled or used solely for internal native messaging transport.