I'm looking for a way to make Google Chrome always open PDFs with its internal viewer when I click a link, as opposed to downloading it to the default location. It works with most URLs, but some servers set a special header to force the file to be downloaded ("Content-Disposition: attachment;", e.g. http://www.uni-goettingen.de/en/46260.html).

What I want is the opposite of this question: Stop PDFs from displaying inside Google Chrome, or what is asked for here, but applied to Chrome: How to ignore “Content-Disposition: attachment” in Firefox

Btw., I'm running Chrome 8.0.552.0 dev on Ubuntu 10.4.

  • 1
    Would it be acceptable if the PDF is opened in Google Docs ? – Sathya Oct 14 '10 at 13:54
  • I think you should tag the OS because some answers appear to be working only on OSX. – Shimmy Sep 6 at 6:24

The "Redirector" answer was just what I was looking for, but that extension is no longer available. So I kept digging and found Modify Content-Type. It's working as I expected (PDFs open in the internal viewer despite Content-Disposition: attachment in the response headers) with a rule of:

URL Filter:       .*
Original Type:    application/.*pdf
Replacement Type: application/pdf
Disposition:      inline

Note well that this may expose you to cross-site scripting vulnerabilities, and you would be wise not to allow .* in the URL filter. Add to it only as needed.

  • I have a rule as follows that seems to work, and should be restricted to PDFs (I don't know about XSS vulnerabilities though, and anything could have a .pdf extension, so still be aware): URL Filter: https?://.*\.pdf Original Type .* Replacement Type: application/pdf Disposition: inline – Scott Stevens Nov 29 '14 at 6:01
  • Can you explain how this filter might make you vulnerable to XSS? – Dai Mar 1 '17 at 18:53
  • owasp.org/index.php/DOM_Based_XSS "Stefano Di Paola and Giorgio Fedon described a universal XSS attack against the Acrobat PDF plugin. This attack applied the fragment variant of DOM based XSS to PDF documents. The researchers discovered that a PDF document served to the browser, when rendered by the Acrobat plugin, may end up executing part of the fragment as Javascript. Since the Javascript is executed in the context (DOM) of the current site, all an attacker needed to exploit this flaw was to simply find a PDF link somewhere on the site for the XSS condition to be met." – Eric Angell Mar 3 '17 at 0:16
  • So many sites use the content-disposition header to protect users from potential exploits such as that. There are other PDF plugins with other potential vulnerabilities, so don't believe that just because that's one old example it means no others could exist. – Eric Angell Mar 3 '17 at 0:17

You can remove Content-Disposition response header using Redirector extension. Just add a rule removing Content-Disposition header. Here how it looks like in Rule Editor: redirector rule

With this rule applied all PDFs will be opened in internal viewer.

  • 2
    Choosing "Wildcard" and "Response Header" from those dropdown menus that look like buttons is important - I missed that at first. – Brilliand Nov 8 '12 at 2:12
  • 2
    Chrome extension no longer available. See superuser.com/a/755252/165804 for an alternative. – Oliver Joseph Ash Jun 13 '14 at 13:44

On the URL bar, type chrome://plugins/, look for the Adobe plugin and click on Disable.

Restart Chrome and load a PDF and the file will load using the Google PDF plugin.

  • Exactly what I had to do to get it working on OS X – Nick Oct 14 '10 at 15:28
  • 3
    Comment by @Kyla: This didn't work for me :( it's just this one website that forces me to download them instead of just viewing them online. – Ivo Flipse Dec 30 '10 at 17:26
  • which version of chorme are you using? it works for me perfect... – Cesar A. Rivas Dec 30 '10 at 20:34
  • 2
    This seems to solve a different problem. See the second question jdm linked to: stackoverflow.com/questions/3251575/… – daxlerod Apr 24 '12 at 19:52
  • 1
    I'm having the same problem; the Chrome PDF plugin is already enabled on my machine. I'm trying to force pages that specify the PDF should be downloaded (for example with a meta refresh or a MIME entry) to open the PDF in a Chrome tab instead, since all I'm going to do is find the PDF on my hard drive and open it there, then have to go find it again later and delete it. I believe the OP was trying to accomplish the same. – Chris Moschini Jul 1 '12 at 19:07

Try the --no-sandbox option.

This should be your shortcut:

"C:\Program Files\Google\Chrome\Application\chrome.exe" --app="http://superuser.com" --no-sandbox
  • How would it work? --no-sandbox should disable sandbox, not ignore HTTP headers, right? – gronostaj Jul 22 '13 at 8:43

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.