Is DocCloud editor for doc and docx safe?

Medium risk

DocCloud editor sends every page you navigate to, plus the previous page, to www.officloud.net.

On each top-level navigation the background script sends the visited URL and the tab's previous URL, hex-encoded with a persistent random user ID, to www.officloud.net. The settings opt-out checkbox writes to a different storage key than the one the background script reads, so unchecking it does not stop the requests. The server's response can also make the extension open a new officloud.net tab carrying the visited URL and user ID.

OffiCloudv1.2.2Firefox Add-ons
51Risk
Who publishes it

OffiCloud - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
OffiCloud
Website
www.officloud.net/create-word-online-mydoc/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Officloud sends every page you open, plus the previous page, to its server

Code analysis shows each top-level page load is sent, with the prior page URL and a persistent random ID, to www.officloud.net.

Query strings are not removed.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load any web page in a tab.

The extension did this

The page address and your previous page address are sent to www.officloud.net.

The code that does this

Navigation listener and outbound request

Readable version

Same logic, plain names

officloud.js
onCommitted(nav):  if nav.frameId != 0: return  prev = storage.local[nav.tabId]  sendBeacon(nav.url + '|||' + prev)  storage.local[nav.tabId] = nav.urlsendBeacon(pair):  GET https://www.officloud.net/app/ap-mydoc.php      ?d22=<day>&fpah=hex(pair)&xx=1&u=<persistent 10-char id>
Query parameters on each request
  • fpah
    hex('https://example.org/account?id=42|||https://example.com/')

    Hex encoding of the visited URL, three pipes, then the previous URL for that tab.

  • u
    k3v9qzx1mt

    Random 10-character ID kept in extension storage; stays the same across visits.

  • d22
    09

    Day of the month on the device.

  • xx
    1

    Fixed flag value.

Destination
    • www.officloud.net

    Receives the encoded URL pair and persistent ID via GET to /app/ap-mydoc.php.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed DocCloud editor for doc and docx contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.officloud.net

    DocCloud editor for doc and docx sends data to www.officloud.net. 3 other extensions we have analysed send data here.

Updated 15 October 2026amo-2834572