Is Free Windows online emulators safe?

Medium risk

Free Windows online emulators sends the full URL of every page you visit to www.onworks.net.

On each tab switch or page update, the background script hex-encodes the full http(s) URL, including path and query, and sends it with a persistent random user ID to onworks.net. The hex encoding is trivially reversible, and the popup offers no consent prompt or toggle for this transmission.

ApkOnline android online emulatorv1.4.2Firefox Add-ons
49Risk
Who publishes it

ApkOnline android online emulator - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ApkOnline android online emulator
Website
www.onworks.net/os-distributions/special-os/windows-10-online-theme

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends the hex-encoded URL of every page you visit to onworks.net

Code analysis shows the background script sends each visited page's full URL, hex-encoded, plus a persistent random ID to www.onworks.net on every tab change.

No consent prompt or toggle was found.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You switch to or load any web page in the browser.

Tab activation and tab update events both fire the handler for any http(s) address.

The extension did this

The extension sends that page's full address, hex-encoded, with a persistent random ID to www.onworks.net.

The request is made from the background script with no prompt shown.

Query parameters in the request to www.onworks.net
  • Full page URL
    https://example.com/account/orders?id=1234 (illustrative)

    The address of the page you are on, including path and query string.

  • Hex encoding
    68747470733a2f2f6578616d706c652e636f6d2f... (illustrative)

    The address is written as hexadecimal character codes, which anyone can decode.

  • Persistent random ID
    k3x9a0qm7z (illustrative)

    A 10-character ID saved in the browser lets the server link your visits over time.

The code that does this

Tab handler and request construction in w.js

Readable version
Third-party destinations
    • www.onworks.net

    Receives the hex-encoded page URL and persistent ID on every tab event.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.4.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Free Windows online emulators contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.onworks.net

    Free Windows online emulators sends data to www.onworks.net. 3 other extensions we have analysed send data here.

Updated 15 October 2026amo-2122956