Is XLS Editor for Google Chrome™ safe?
XLS Editor is low risk. Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview. This differs from the publisher domain (freebusinessapps.net) and isn't disclosed. A tracking pixel loads on every UI open.
Who publishes itfreebusinessapps - 11 other listings from the same operator, none carrying a finding
freebusinessapps - 11 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 480k+ users between them, none of them carrying a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
User-Selected Files Sent to Third-Party Server on File Open
Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview.
This differs from the publisher domain (freebusinessapps.net) and isn't disclosed.
A tracking pixel loads on every UI open.
What actually happens
You click 'Open Spreadsheet File' and select a local file in the file picker.
The extension immediately POSTs the entire file to https://www.opendocumentsonline.com/upload via a multipart/form-data HTTP request.
No confirmation prompt is shown. The upload occurs automatically as soon as the file is selected.
Captured request
Dynamic analysis confirmed POST transmitted; a planted marker value was observed in the captured request body.
- Content-Type
- multipart/form-data; boundary=----WebKitFormBoundaryXyz1234AbCd
------WebKitFormBoundaryXyz1234AbCdContent-Disposition: form-data; name="file"; filename="example.xls"Content-Type: application/vnd.ms-excel[full file contents — dynamic analysis sent a 512-byte planted marker value; body confirmed present by dynamic analysis, observed requests]------WebKitFormBoundaryXyz1234AbCd--The code that does this
File upload form construction and submission in document.js
(function () { var panel = $("#open-documents-online"); var form = $("<form></form>"); form.attr("action", "https://www.opendocumentsonline.com/upload") .attr("method", "POST") .attr("enctype", "multipart/form-data") .addClass("convert-form"); var txtFile = $("<input name='file' type='file' style='display: none' />") form.append(txtFile); // Hidden tracking pixel loaded on every page open form.append("<img style='display: none' src='https://www.opendocumentsonline.com/pixel.png' />"); panel.on("click", ".btn-open", function () { panel.find("[name='file']").click(); }); // Submits immediately on file selection — no confirmation txtFile.change(function () { if (txtFile[0].files.length) { form.submit(); } });})();External hosts receiving data from the extension
- www.opendocumentsonline.com
Receives uploaded file contents via multipart POST on every file-open action, plus a tracking pixel GET on every UI page load. Distinct from publisher domain freebusinessapps.net.
Publisher domain relationship
The extension's homepage URL is https://xls-editor-welcome.freebusinessapps.net/. The upload and tracking destination opendocumentsonline.com appears to be operated by the same publisher based on co-branding, but it is a distinct registered domain. The Chrome Web Store listing for the extension does not name opendocumentsonline.com as an upload destination.