Is Kdenlive video editor safe?

Medium risk

Kdenlive video editor sends the hex-encoded URL of each page you navigate to, once a day, to runapps.org.

The extension is a launcher for an online Kdenlive web app, but its background script reads top-level navigations and uploads the page URL, the previous URL and a persistent random user ID to www.runapps.org at most once per day. The only opt-out is an 'Online integration' checkbox in the popup, which does not describe the data sent. Visiting URLs ending in .bnt or .blen also sends that URL to runapps.org, which can respond by opening a runapps.org page in a new tab.

RunAppsv1.1.6Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/kdenlive-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Kdenlive launcher sends your visited and previous page URLs to runapps.org daily

Code analysis shows the add-on sends the hex-encoded address of a visited page and the previous page, with a persistent ID, to www.runapps.org once per day.

It is on by default.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a web page in a tab.

Applies to any top-level navigation on any http or https site.

The extension did this

The add-on sends that page address and the tab's previous address to www.runapps.org.

The request is limited to the first navigation of each calendar day.

Query parameters on the daily request
  • Visited page
    https://example.com/?q=test

    The full address of the page you just opened, including its query string.

  • Previous page
    https://example.com/

    The address this tab showed before, so two steps of your browsing are linked.

  • Install ID
    k3q9vz1mta

    A random 10 character ID stored on this install; it stays the same across visits.

  • Day of month
    09

    Used to limit the upload to one per day.

The code that does this

Navigation listener and upload call

Readable version

Listener reads the stored previous URL, passes current|||previous to avisyu(), then saves the current URL for the tab.

runapps.js
        chrome.webNavigation.onCommitted.addListener(function(ddaiss) {                        if ( ddaiss && ddaiss.url )            {                if (ddaiss.frameId !== 0) {  return; }                if ( ddaiss.transitionType &&   ( ddaiss.transitionType.indexOf("frame") <= 0 ) )                {                    uullr =  ddaiss.url;                    chrome.storage.local.get(ddaiss.tabId.toString(), function (item) {                            var urla = item[ddaiss.tabId.toString()];                            avisyu(uullr + "|||" + urla);                                                    var tiu = {};                            tiu[ddaiss.tabId.toString()] = uullr;                            chrome.storage.local.set(tiu);                    });                }

Plain hex encoding of each character, so the URL is trivially reversible.

runapps.js
function b2hxx (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}

GET to runapps.org with the hex string and install ID.

runapps.js
    if ( zzcc.myruop == "0")         return;                        let r56y = await fetch('https://www.runapps.org/app/applicaton-kdenlive.php?d22=' + d22 + '&fpah=' + b2hxx(uullrx) + '&xx=1&u=' + un);
Reproduce it yourself

Decodes the fpah value sent to runapps.org back to the visited and previous page addresses.

Requires
  • Node.js 18+
decode-fpah.js · js
// node decode-fpah.js <hex>const hex = process.argv[2] || '';let out = '';for (let i = 0; i < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.substr(i, 2), 16));console.log(out);
How to run it
  1. 1node decode-fpah.js 68747470733a2f2f6578616d706c652e636f6d2f3f713d746573747c7c7c68747470733a2f2f6578616d706c652e636f6d2f
Where the data goes
    • www.runapps.org

    Receives the encoded page URLs and install ID at /app/applicaton-kdenlive.php; operator of the Kdenlive web launcher.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Kdenlive video editor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Kdenlive video editor sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2833848