Is Kodi online XBMC Media Center safe?
The extension sends the hex-encoded URL of every web page you visit to www.onworks.net.
On each tab switch or page load, the background script reads the page URL and sends it, hex-encoded, with a persistent random user ID to www.onworks.net. This happens for all http(s) pages except onworks sites, and the hex encoding is not encryption. If the server's reply contains '302', the extension redirects the current tab to an onworks.net page.
Who publishes itApkOnline android online emulator - no other listings under this identity
ApkOnline android online emulator - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Add-on sends every page address you open to onworks.net with a persistent ID
Code analysis shows the add-on sends the hex-encoded address of each http(s) page you visit to www.onworks.net, tagged with a random ID stored in the browser.
Hex is an encoding, not encryption.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a page or switch tabs in the browser.
Any http(s) page not containing 'onworks' qualifies.
The add-on sends that page's address, hex-encoded, to www.onworks.net.
The request carries a persistent random ID.
- url68747470733a2f2f6578616d706c652e636f6d2f6163636f756e742f6f72646572733f69643d3432
Full address of the page you are on, hex-encoded.
- hex1
Flag telling the server the URL is hex-encoded.
- uk3x9qa7v2m
Random 10-character ID kept in local storage across visits.
Tab listener and outbound request in w.js
Tab URL passed to the sender (w.js lines 4-14, as shipped, unminified)
function gti(tabId) { chrome.tabs.get(tabId, function(tab) { if ((tab.url.indexOf("onworks") == -1) && (tab.url.indexOf("http") !== -1) && (lastUrl != tab.url)) { urlx = tab.url; reporturlscannedandrecorded = urlx; extractf(reporturlscannedandrecorded); lastUrl = tab.url; } });}Hex encoder b2x (w.js lines 106-115)
function b2x (bin){ var i = 0, l = bin.length, chr, hex = '' for (i; i < l; ++i) { chr = bin.charCodeAt(i).toString(16) hex += chr.length < 2 ? '0' + chr : chr } return hex}- www.onworks.net
Receives the hex-encoded URL and ID; its reply can trigger a tab redirect to intro-kodi-os.php.
Turns the hex 'url' parameter back into the original page address.
- Node.js 18+
const hex = process.argv[2];if (!hex) { console.error('usage: node decode-url.js <hex>'); process.exit(1); }let out = '';for (let i = 0; i < hex.length; i += 2) out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));console.log(out);- 1node decode-url.js 68747470733a2f2f6578616d706c652e636f6d2f
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed Kodi online XBMC Media Center contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.onworks.net
Kodi online XBMC Media Center sends data to www.onworks.net. 3 other extensions we have analysed send data here.