Is LibreOffice writer online safe?
LibreOffice writer online sends every page you navigate to, hex-encoded with a persistent ID, to www.runapps.org.
The extension's background script listens for each top-level navigation and sends the visited URL and the tab's previous URL, with a random persistent user ID, to runapps.org. URLs ending in .doc or .docx are also sent separately, and the server can respond by opening a runapps.org tab. The settings opt-out checkbox writes a different storage key than the background reads, so it does not stop this.
Who publishes itRunApps - no other listings under this identity
RunApps - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
LibreOffice launcher sends each page you open, plus the last, to runapps.org
Code analysis shows each main-frame page load triggers a request to runapps.org carrying the hex-encoded page URL, the prior URL and a persistent random ID.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any web page in a tab.
Only top-level loads count; embedded frames are skipped.
The extension requests runapps.org with that page address and the previous one, hex-encoded.
A stored random ID is attached to every request.
- Visited page (fpah)https://example.com/account|||https://example.org/
The address of the page you just opened, followed by the previous page in that tab.
- Previous pagehttps://example.org/
Links consecutive visits in one tab into a browsing trail.
- Persistent ID (u)k3x9qa0m2z
A random 10-character ID kept in local storage lets the server recognise the same install.
- Day of month (d22)09
Two-digit day used by the request gate.
Navigation listener and request builder
Hex encoder used for the URL
runapps.jsfunction b2hxx (bin){ var i = 0, l = bin.length, chr, hex = '' for (i; i < l; ++i) { chr = bin.charCodeAt(i).toString(16) hex += chr.length < 2 ? '0' + chr : chr } return hex}On an interval
The request repeats on each navigation until the server reply contains OKOK; that sets a day-of-month flag which suppresses further requests for the rest of that day.
- Key the settings page writesmrunappsi
The checkbox saves its state under a different name.
- Key the background readsrunappsi
The request path checks this key, so the toggle has no effect on it.
- www.runapps.org
Receives visited and previous URLs plus the persistent ID; may open a runapps.org page with the same values.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed LibreOffice writer online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.runapps.org
LibreOffice writer online sends data to www.runapps.org. 16 other extensions we have analysed send data here.