Is XLS Editor for Google Chrome™ safe?

High risk

XLS Editor is high risk. Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview. This differs from the publisher domain (freebusinessapps.net) and isn't disclosed. A tracking pixel loads on every UI open.

freebusinessappsv3.0.0Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

User-Selected Files Sent to Third-Party Server on File Open

Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview.

This differs from the publisher domain (freebusinessapps.net) and isn't disclosed.

A tracking pixel loads on every UI open.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You click 'Open Spreadsheet File' and select a local file in the file picker.

The extension did this

The extension immediately POSTs the entire file to https://www.opendocumentsonline.com/upload via a multipart/form-data HTTP request.

No confirmation prompt is shown. The upload occurs automatically as soon as the file is selected.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://www.opendocumentsonline.com/upload
Dynamic analysis confirmed POST transmitted; a planted marker value was observed in the captured request body.
Headers
Content-Typemultipart/form-data; boundary=----WebKitFormBoundaryXyz1234AbCd
Body
------WebKitFormBoundaryXyz1234AbCd
Content-Disposition: form-data; name="file"; filename="example.xls"
Content-Type: application/vnd.ms-excel

[full file contents — dynamic analysis sent a 512-byte planted marker value; body confirmed present by dynamic analysis, observed requests]
------WebKitFormBoundaryXyz1234AbCd--
03EvidenceCODE COMPARE
The code that does this

File upload form construction and submission in document.js

What it actually does
(function () {
 var panel = $("#open-documents-online");
 var form = $("<form></form>");

 form.attr("action", "https://www.opendocumentsonline.com/upload")
 .attr("method", "POST")
 .attr("enctype", "multipart/form-data")
 .addClass("convert-form");

 var txtFile = $("<input name='file' type='file' style='display: none' />")
 form.append(txtFile);

 // Hidden tracking pixel loaded on every page open
 form.append("<img style='display: none' src='https://www.opendocumentsonline.com/pixel.png' />");

 panel.on("click", ".btn-open", function () {
 panel.find("[name='file']").click();
 });

 // Submits immediately on file selection — no confirmation
 txtFile.change(function () {
 if (txtFile[0].files.length) {
 form.submit();
 }
 });
})();
04EvidenceTHIRD PARTY LIST
External hosts receiving data from the extension
  • www.opendocumentsonline.com

    Receives uploaded file contents via multipart POST on every file-open action, plus a tracking pixel GET on every UI page load. Distinct from publisher domain freebusinessapps.net.

05EvidencePLAIN NOTE
Publisher domain relationship

The extension's homepage URL is `https://xls-editor-welcome.freebusinessapps.net/`. The upload and tracking destination `opendocumentsonline.com` appears to be operated by the same publisher based on co-branding, but it is a distinct registered domain. The Chrome Web Store listing for the extension does not name `opendocumentsonline.com` as an upload destination.

Updated 17 September 2026dlmhlglpiggjfklgjpnpkjedoghgfkhn