Is Handbrake - video converter safe?

Medium risk

Handbrake - video converter sends the URL of every page you open, plus the previous URL, to runapps.org.

The background script listens for top-level navigations and sends the hex-encoded page URL and the tab's previous URL to www.runapps.org, tagged with a persistent random user ID, at most once per day. It also sends the URL when you open a link ending in .bnt or .blen, and the server's reply can open a runapps.org tab. The popup opt-out checkbox writes a different storage key than the one the background script reads, so toggling it does not stop the collection.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends each page URL and the previous one to runapps.org daily

Code analysis shows each top-level navigation URL and the tab's previous URL are hex-encoded and sent with a persistent ID to www.runapps.org, at most once per day.

The popup opt-out does not stop it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The user loads any page in a tab's top-level frame.

The extension did this

The background script hex-encodes the URL and the tab's previous URL and sends them to www.runapps.org.

Query parameters sent to www.runapps.org
  • fpah
    68747470733a2f2f6578616d706c652e636f6d2f(illustrative)

    Hex of the current URL, then |||, then the tab's previous URL.

  • u
    k3x9ab2qzt (illustrative)

    Random 10-character ID kept in local storage, so visits can be linked over time.

  • d22
    08

    Day of month, used to limit sends to one per day.

  • xx
    1

    Constant flag.

The code that does this

Navigation listener and outbound request

Readable version

Hex encoder

runapps.js
function b2hxx(bin){var i=0,l=bin.length,chr,hex='';for(i;i<l;++i){chr=bin.charCodeAt(i).toString(16);hex+=chr.length<2?'0'+chr:chr}return hex}
What actually happens
You did this

The user unticks the popup opt-out checkbox.

The extension did this

The popup writes storage key mrunappsi, but the background reads runappsi, so collection continues.

Destination
    • www.runapps.org

    Receives the URL pair and ID; reply OKOK opens a runapps.org tab.

Check if you're affected

Decodes the fpah value into the current and previous URLs.

Requires
  • Node.js 18+
decode_fpah.js · js
// Decode the fpah query parameter sent to runapps.orgconst fpah = process.argv[2];const s = Buffer.from(fpah, 'hex').toString('utf8');const [current, previous] = s.split('|||');console.log({ current, previous });
How to run it
  1. 1node decode_fpah.js <hex fpah value>
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Handbrake - video converter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Handbrake - video converter sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2833941