Is Android developer Cordova online for Android APK safe?

Medium risk

Android developer Cordova online sends every URL you visit, hex-encoded, to www.uptoplay.net.

The background script reports each page you navigate to, with the query string removed, to uptoplay.net on all http and https sites, including frames. URLs ending in .apk or .apkx are sent with a persistent random user ID, and a server reply can make the extension open a new tab on uptoplay.net.

ApkOnline android online emulatorv1.5.4Firefox Add-ons
51Risk
Who publishes it

ApkOnline android online emulator - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ApkOnline android online emulator
Website
www.uptoplay.net

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Add-on sends the address of pages you open to uptoplay.net, hex-encoded

Code analysis shows the add-on sends the address of each page you load, minus the query string, hex-encoded, to www.uptoplay.net.

The listener covers every http and https site.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page.

This includes pages loaded inside frames.

The extension did this

The add-on requests a uptoplay.net URL carrying the hex-encoded page address.

The query string is removed first.

The code that does this

Navigation listener and outbound request

Readable version

Hex encoder applied to the page address

w.js
function b2x (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}
Query parameters on the outbound request
  • url
    68747470733a2f2f6578616d706c652e636f6d2f6163636f756e742f736574

    The page address you loaded, without its query string, as hex text.

  • dx
    09

    The day of the month on your device.

  • hex
    1

    Flag stating the address is hex-encoded.

Destination
    • www.uptoplay.net

    Receives the encoded page address at /media/system/ext/c-cordova.php.

Controls found in the code
  • apkon_d token
    stored after reply

    Set from the first two characters of a server reply containing OKOKOK; limits further sends.

  • apkononline
    1

    Stored value '0' stops the requests; no option in the shipped UI sets it.

  • OKOKOK reply
    intro-cordova.php?url=<hex>

    A reply containing this marker opens a new tab on uptoplay.net.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.5.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Android developer Cordova online for Android APK contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.uptoplay.net

    Android developer Cordova online for Android APK sends data to www.uptoplay.net. 2 other extensions we have analysed send data here.

Updated 15 October 2026amo-2730683