Is Format Factory online safe?

Medium risk

The extension sends every page URL you navigate to, plus the previous URL, to www.winfy.net once per day.

On each top-level navigation the background script hex-encodes the current and previous URL, including query strings, and sends them with a persistent random user ID to winfy.net, gated to once per day-of-month. Depending on the server's reply, it can also open a winfy.net page in a new tab carrying the visited URL and the tracking ID. No consent prompt is shown; the popup is a static page.

Winfyv1.1.2Firefox Add-ons
51Risk
Who publishes it

Winfy - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Winfy
Website
www.winfy.net/format-factory-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Format Factory add-on sends each page URL and the prior URL to winfy.net daily

Code analysis shows the add-on hex-encodes each top-level page URL and the tab's prior URL and sends them with a random ID to www.winfy.net, once per day-of-month gate.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open or navigate to any web page in a tab.

Applies to top-level http and https navigations.

The extension did this

The add-on sends that page address and the tab's previous address to www.winfy.net.

The values are only hex-encoded and sent with a persistent random ID.

The code that does this

Navigation listener passes current and previous URL

Readable version

Persistent random user ID

ws.js
let strR = await chrome.storage.local.get([winfykeyx]);if (winfykeyx in strR) { dxtt = strR[winfykeyx] }if ( dxtt.uxr ) { uxr = dxtt.uxr; }else { uxr = "" + rssXs(10) + "".toLowerCase(); dxtt.uxr = uxr; }

Outbound request

ws.js
let responsecheck = await fetch('https://www.winfy.net/app/appwfformatfactory.php?dx=' + dx + '&filepath=' + bin2hex(myurix) + '&hex=1&u=' + un);
Query parameters sent to winfy.net
  • filepath
    68747470733a2f2f6578616d706c652e636f6d2f...

    Current page address and previous address joined by |||, hex-encoded.

  • u
    10 random characters

    Random 10-character ID generated once and kept in local storage.

  • dx
    09

    Current day of the month, used for the once-per-day gate.

  • hex
    1

    Flag stating the filepath value is hex-encoded.

Destination host
    • www.winfy.net

    Receives URL pairs and may reply OKOKOK to trigger a new tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Format Factory online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.winfy.net

    Format Factory online sends data to www.winfy.net. 6 other extensions we have analysed send data here.

Updated 15 October 2026amo-2832817