Is LibreOffice Calc online safe?

Medium risk

LibreOffice Calc online sends the hex-encoded URL of every page you open, plus the previous URL, to www.runapps.org.

The background script reports each top-level page navigation, including the prior URL for that tab and a persistent random user ID, to www.runapps.org, and the 'Online integration' opt-out toggle does not stop this because it writes to a different storage key than the one the script reads. Separately, opening a .xls or .xlsx link sends that URL to runapps.org and can open an online spreadsheet editor tab, which matches the advertised purpose.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/libreoffice-calc-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

LibreOffice Calc Online sends every page you open, hex-encoded, to runapps.org

Code analysis shows each top-level page you open, plus the previous URL in that tab, is sent to www.runapps.org with a persistent ID.

The Online integration opt-out writes to a different storage key.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a web page in a tab, by link or typed address.

Subframe loads are skipped; only top-level navigations count.

The extension did this

The extension requests www.runapps.org with the page URL and the tab's previous URL, hex-encoded.

A random 10-character ID saved in storage is attached to every request.

Query parameters sent to runapps.org
  • Visited page
    https://mail.example.com/inbox?folder=billing

    The full address of the page you just opened, including path and query string.

  • Previous page
    https://www.example.org/account/orders

    The address that tab showed before, placed after a ||| separator.

  • Persistent ID
    u=k3x9qw2m7d

    A random ID created once and reused, so requests can be linked over time.

  • Day of month
    d22=09

    Two-digit day used with a server-supplied value to limit how often requests go out.

Why you can't catch this in DevTools

The URL pair is converted to hexadecimal, which is reversible by anyone without a key.

Decoded value
https://mail.example.com/inbox?folder=billing|||https://www.example.org/account/orders
The code that does this

Opt-out reads a different storage key than the settings page writes

Readable version

Navigation listener that feeds the reporter

runapps.js
chrome.webNavigation.onCommitted.addListener(function(ddaiss) {    if (ddaiss.frameId !== 0) {  return; }    if ( ddaiss.transitionType && ( ddaiss.transitionType.indexOf("frame") <= 0 ) ) {        uullr = ddaiss.url;        chrome.storage.local.get(ddaiss.tabId.toString(), function (item) {            var urla = item[ddaiss.tabId.toString()];            avisyu(uullr + "|||" + urla);            var tiu = {};            tiu[ddaiss.tabId.toString()] = uullr;            chrome.storage.local.set(tiu);        });    }});
Where the data is sent
    • www.runapps.org

    Receives the hex-encoded URL pair and persistent ID; its response can also trigger a new tab and set request frequency.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed LibreOffice Calc online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    LibreOffice Calc online sends data to www.runapps.org. 16 other extensions we have analysed send data here.