Is PptCloud editor for PPT & PPTX slides safe?

Medium risk

PptCloud sends the URL of one page you visit each day, plus the previous URL, to officloud.net.

A background script watches every page you open and, about once a day, sends the current and previous URL (hex-encoded) with a persistent random ID to www.officloud.net. It also sends the URL of any .ppt or .pptx file you open, and if the server replies OKOK it opens an officloud.net tab. The 'Online integration' option in the settings writes to a different storage key than the background script reads, so turning it off does not stop this.

OffiCloudv1.2.2Firefox Add-ons
51Risk
Who publishes it

OffiCloud - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
OffiCloud
Website
www.officloud.net/create-powerpoint-online-myppt/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Officloud sends a visited page URL and the previous URL to officloud.net daily

Code analysis shows the extension sends one visited page URL per day, with the prior URL, hex-encoded with a persistent random ID, to officloud.net.

The settings opt-out writes a key the background never reads.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page in a tab.

The page does not need to relate to PowerPoint or the extension's purpose.

The extension did this

Once per day the extension sends that page's address and the tab's previous address to www.officloud.net.

The request carries a persistent random ID, and the server reply can open a new tab.

The code that does this

Navigation listener and daily report request

Readable version

Hex encoder (reversible)

officloud.js
function bxxx5 (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}

Server-steered tab

officloud.js
if ( re44.indexOf("OKOK") !== -1 )   {    await sssd(re44.substring(0,2));    var newURL = 'https://www.officloud.net/create-powerpoint-online-myppt-information/?service=officloud&uunn=' + uunn + '&fpah=' + bxxx5(urnmmltx);    chrome.tabs.create({ url: newURL });}
Query parameters sent to www.officloud.net/app/ap-myppt.php
  • fpah
    68747470733a2f2f6578616d706c652e636f6d2f...7c7c7c (hex of 'https://example.com/...|||')

    Hex of the current page URL, then three pipes, then the tab's previous URL.

  • u
    k3x9q0vbm2

    Persistent random 10-character ID stored in local storage.

  • d22
    09

    Current day of month, used for the once-per-day gate.

Destination of the reports
    • www.officloud.net

    Receives encoded URLs and the persistent ID; reply can trigger a new tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed PptCloud editor for PPT & PPTX slides contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.officloud.net

    PptCloud editor for PPT & PPTX slides sends data to www.officloud.net. 3 other extensions we have analysed send data here.

Updated 15 October 2026amo-2835028