Is Wine online for Winapps safe?

Medium risk

Wine online for Winapps sends the full URL of every page you open, plus the previous URL, to www.winfy.net.

The background script reads each top-level navigation and sends the hex-encoded URL, including query strings, the tab's previous URL and a persistent random ID, to www.winfy.net about once a day. It also sends the URL of any .exe or .msi download you navigate to. When the server replies, the extension may open a Winfy promotional tab. The UI does not disclose this.

Winfyv1.1.2Firefox Add-ons
51Risk
Who publishes it

Winfy - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Winfy
Website
www.winfy.net/wine-online/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension sends each page address you open, plus the previous one, to winfy.net

Code analysis shows the extension sends the full address of each page you open, with the prior address for that tab and a persistent ID, to www.winfy.net, at most once a day.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page in a tab.

Only top-level navigations on http and https pages are handled.

The extension did this

The extension sends that page address and the tab's previous address to www.winfy.net.

The request is limited to roughly once per day.

Values in the request to www.winfy.net/app/appwfwine.php
  • Current page address
    https://example.com/account/orders?id=48213

    The full address of the page you just opened, including any query string.

  • Previous page address
    https://example.com/search?q=wine

    The last address loaded in the same tab, so the visits are linked together.

  • Persistent ID
    k3p9x0qtzb

    A random 10-character ID stored locally, so repeat sends can be tied to one install.

  • Day of month
    09

    Used for the once-a-day limit on sending.

The code that does this

Navigation listener that pairs each URL with the tab's previous URL

Readable version

Same logic, as read from the deobfuscated copy

ws.js
// on each top-level navigation://   previous = storage.local[tabId]//   send(hex(currentUrl + '|||' + previous))//   storage.local[tabId] = currentUrl// send() is skipped if today's day-of-month matches the stored gate value
The code that does this

Reply handling: a response containing OKOKOK stores a gate value and opens a tab

Readable version
ws.js
// if server reply contains the marker://   remember first 2 chars of reply as today's gate//   open a new tab at winfy.net carrying the ID and the hex-encoded URLs
Destination of the request
    • www.winfy.net

    Receives hex-encoded page addresses and the install ID; may reply with a marker that opens a winfy.net tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Wine online for Winapps contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.winfy.net

    Wine online for Winapps sends data to www.winfy.net. 6 other extensions we have analysed send data here.

Updated 15 October 2026amo-2832073