Google Scholar Pdf Reader
✨ AI-Powered 🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Lets you supercharge your paper reading with Google Scholar Pdf Reader, a popular extension used by 1,000,000 users, allowing you to follow references, skim outlines, jump to figures, and cite papers directly from within Chrome. This tool is particularly beneficial for students, researchers, and academics who spend most of their time reading scholarly articles online. By integrating with Google Scholar, the extension streamlines the research process, saving time and increasing productivity.
Overview
When you install Scholar Reader, PDFs on all sites will have a new look in Chrome. To make this happen, Chrome will ask for permissions to read and change data on all sites. Scholar Reader makes no changes other than the presentation of PDFs.
• Preview references as you read. Click the in-text citation to see a summary and find the PDF.
• Read faster with the AI outline. Get a quick overview and click on interesting bullets to jump within the paper.
• Highlight and comment on PDFs. Highlights are saved to your Scholar library.
• Make it right for your eyes with light, dark, and night modes.
• Copy and paste common citation formats without leaving the paper.
• Save articles to your Scholar Library to read or cite later.
• Click in-text figure mentions to see the figure and the back button to keep reading.
By installing this extension, you agree to the Google Terms of Service and Privacy Policy at https://www.google.com/intl/en/policies/.
Tags
Privacy Practices
Security Analysis — Google Scholar Pdf Reader
Permissions
Code Patterns Detected
External Connections
Package Contents 239 files · 10.9MB
What This Extension Does
Google Scholar Pdf Reader is a browser extension that enhances PDF reading experience by providing features such as previewing references, creating AI outlines, highlighting and commenting on PDFs, and saving articles to a library. It's designed for users who want to improve their productivity while reading papers. However, its broad permissions raise concerns about data exposure and potential security risks.
Permissions Explained
- webNavigationexpected: This permission allows the extension to monitor and control navigation within web pages.
Technical: ThewebNavigationAPI grants access to Chrome's navigation history, allowing the extension to intercept and modify user interactions. This can be used for legitimate purposes like tracking user behavior or providing analytics, but also poses a risk if compromised. - webRequestexpected: This permission allows the extension to intercept and modify network requests made by web pages.
Technical: ThewebRequestAPI grants access to Chrome's request and response data, allowing the extension to inspect and manipulate user traffic. This can be used for legitimate purposes like ad-blocking or content filtering, but also poses a risk if compromised. ⚠ 1 - declarativeNetRequestexpected: This permission allows the extension to define rules for network requests without needing to intercept them.
Technical: ThedeclarativeNetRequestAPI grants access to Chrome's request and response data, allowing the extension to inspect and manipulate user traffic. This can be used for legitimate purposes like ad-blocking or content filtering, but also poses a risk if compromised. - scriptingexpected: This permission allows the extension to execute scripts on web pages.
Technical: ThescriptingAPI grants access to Chrome's content script injection, allowing the extension to inject and execute scripts on web pages. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised. - storageexpected: This permission allows the extension to store and retrieve data on the user's device.
Technical: ThestorageAPI grants access to Chrome's storage mechanisms, allowing the extension to store and retrieve data on the user's device. This can be used for legitimate purposes like storing user preferences or tracking behavior, but also poses a risk if compromised. - offscreenexpected: This permission allows the extension to create and control off-screen windows.
Technical: TheoffscreenAPI grants access to Chrome's window creation mechanisms, allowing the extension to create and control off-screen windows. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised. - clipboardWriteexpected: This permission allows the extension to write data to the clipboard.
Technical: TheclipboardWriteAPI grants access to Chrome's clipboard mechanisms, allowing the extension to write data to the user's clipboard. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised. - <all_urls>check this: This permission allows the extension to access all web pages and URLs.
Technical: The<all_urls>permission grants access to Chrome's URL handling mechanisms, allowing the extension to intercept and modify user interactions on any web page. This poses a critical risk if compromised. ⚠ 1
Your Data
The extension accesses various data on the user's device, including storage, clipboard content, and network traffic. It also sends data to several domains, including Google Scholar, XFA, and Adobe.
Technical Details
- scholar.google.com
- www.xfa.org
- ns.adobe.com
- github.com
- docs.google.com
- about.jstor.org
- www.tandfonline.com
- accounts.google.com
- www.apache.org
- b.corp.google.com
- http
- https
- cookies
- tokens
- page content
Code Findings
The extension uses the eval() function to execute arbitrary code, which can pose a risk if compromised.
Technical: The eval() function is used in several JavaScript files (e.g., contentScript.js, backgroundScript.js) to execute dynamic code. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised.
💡 Legitimate extensions may use eval() for dynamic code execution, such as parsing JSON data or executing user-provided scripts.
The extension uses the function constructor to execute arbitrary code, which can pose a risk if compromised.
Technical: The function constructor is used in several JavaScript files (e.g., contentScript.js, backgroundScript.js) to execute dynamic code. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised.
💡 Legitimate extensions may use the function constructor for dynamic code execution, such as parsing JSON data or executing user-provided scripts.
The extension loads external scripts in its service worker, which can pose a risk if compromised.
Technical: The serviceWorker.js file loads several external scripts (e.g., https://cdn.jsdelivr.net/npm/...) using the fetch() API. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised.
💡 Legitimate extensions may load external scripts in their service workers to provide additional functionality or track user behavior.
The extension uses innerHTML assignments, which can pose a risk if compromised due to potential XSS vulnerabilities.
Technical: Several JavaScript files (e.g., contentScript.js, backgroundScript.js) use innerHTML assignments to inject content into web pages. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised.
💡 Legitimate extensions may use innerHTML assignments to provide additional functionality or track user behavior.
The extension uses String.fromCharCode() and charCodeAt() functions, which can be used for obfuscation.
Technical: Several JavaScript files (e.g., contentScript.js, backgroundScript.js) use String.fromCharCode() and charCodeAt() functions to manipulate strings. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised due to potential obfuscation.
💡 Legitimate extensions may use these functions for string manipulation or obfuscation.
The extension uses the unescape() function, which is deprecated and can pose a risk if compromised due to potential XSS vulnerabilities.
Technical: Several JavaScript files (e.g., contentScript.js, backgroundScript.js) use the unescape() function to manipulate strings. This can be used for legitimate purposes like providing functionality or tracking user behavior, but also poses a risk if compromised due to potential XSS vulnerabilities.
💡 Legitimate extensions may use unescape() for string manipulation, but it is deprecated and should be avoided.
The Google Scholar Pdf Reader extension has several security concerns due to its broad permissions and potential code vulnerabilities. While it provides useful functionality for users, we recommend exercising caution when installing this extension and monitoring its behavior closely.
