Is Blender 3D creation suite safe?

Medium risk

Blender 3D creation suite sends the hex-encoded URL of your page navigations to www.runapps.org, about once per day.

The background script watches every top-level page load and sends the current URL plus the previous tab URL, hex-encoded with query strings included, along with a persistent random user ID. The 'Online integration' opt-out checkbox writes a different storage key than the background reads, so unchecking it does not stop this. Opening a .bnt or .blen file URL also sends that URL to runapps.org, and the server's reply can open a runapps.org tab.

RunAppsv1.1.8Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/blender-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Runapps sends each page URL and the previous one to runapps.org

Code analysis shows the extension sends the address of each page you open, and the one before it, to runapps.org about once a day.

The opt-out checkbox on its settings page does not stop this.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page in the main frame of any tab.

The extension did this

The extension sends that page address and the tab's previous address to www.runapps.org.

Data in the request to runapps.org
  • Visited page address
    https://example.com/account?id=1042

    The full address you opened, including any query string.

  • Previous page address
    https://example.org/

    The address last loaded in the same tab.

  • Random install ID
    k3x9qd7w2m (illustrative)

    A 10-character ID kept in storage and sent each time.

  • Day of month
    09

    Used by the extension to limit sends to about one a day.

The code that does this

Navigation listener and the send routine

Readable version

What the listener does

runapps.js
// On each top-level navigation (frameId 0, transitionType without 'frame'):// 1. read the tab's previous URL from chrome.storage.local[tabId]// 2. send currentUrl + '|||' + previousUrl via avisyu()// 3. store currentUrl as the tab's new previous URL

What the send routine does

runapps.js
// avisyu(): skip if already sent today (day-of-month minus 1 gate)// load or create a random 10-char ID in storage key 'runappsi'// if settings.myruop == '0' return  (only set via key 'runappsi')// GET https://www.runapps.org/app/applicaton-blender.php?d22=<day>&fpah=<hex(url|||prev)>&xx=1&u=<id>// if response contains 'OKOK': open runapps.org/blender-online-information/ tab with fpah
The code that does this

Settings checkbox writes a different storage key than the sender reads

Readable version

Effect

js/custom.js
// Unchecking 'Online integration' updates 'mrunappsi'.// The background script only checks 'runappsi', whose default is myruop = '1'.// The opt-out therefore does not change what is sent.
Why you can't catch this in DevTools

The page addresses in the request are hex-encoded, which anyone can reverse.

Decoded value
https://example.com/|||https://example.org/
Where the data goes
    • www.runapps.org

    Receives the hex-encoded addresses and install ID; can reply OKOK to open a runapps.org tab.

Reproduce it yourself

Decodes the fpah value from a request to runapps.org back into the visited and previous addresses.

Requires
  • Node.js 18+
decode-fpah.js · js
const hex = process.argv[2] || '';const text = Buffer.from(hex, 'hex').toString('utf8');const [current, previous] = text.split('|||');console.log(JSON.stringify({ current, previous }, null, 2));
How to run it
  1. 1node decode-fpah.js 68747470733a2f2f6578616d706c652e636f6d2f7c7c7c68747470733a2f2f6578616d706c652e6f72672f
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Blender 3D creation suite contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Blender 3D creation suite sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2833718