Is XlsCloud editor for Xls and Xlsx safe?

Medium risk

XlsCloud sends the URL of every page you visit, plus the previous URL, to officloud.net.

On each top-level navigation the extension sends the full page URL and the tab's previous URL, hex-encoded with a persistent random ID, to officloud.net, gated by a server reply. When you open a .xls or .xlsx link it also sends that URL to officloud.net, which can respond by opening a vendor tab. The 'Online integration' setting writes a different storage key than the one the background script reads, so it does not switch this off.

OffiCloudv1.2.2Firefox Add-ons
51Risk
Who publishes it

OffiCloud - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
OffiCloud
Website
www.officloud.net/create-excel-online-myxls/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Officloud sends each page URL and the previous page URL to its own server

Code analysis shows each top-level page load sends the full URL, the tab's previous URL and a persistent random ID to officloud.net.

The code limits this to once per day after a server reply.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page in a tab.

Only top-level navigations count; sub-frames are skipped.

The extension did this

The extension sends that page's URL and the tab's previous URL to officloud.net.

The request is made in the background with no visible prompt.

The code that does this

Navigation listener and beacon request

Readable version

Listener

officloud.js
chrome.webNavigation.onCommitted.addListener(function(details) {    if (details.frameId !== 0) return;    // runs for top-level navigations    chrome.storage.local.get(String(details.tabId), function(items) {        const previousUrl = items[String(details.tabId)];        avisyu(details.url + '|||' + previousUrl);        chrome.storage.local.set({[String(details.tabId)]: details.url});    });});

Request

officloud.js
const resp = await fetch('https://www.officloud.net/app/ap-myxls.php?d22=' + dayOfMonth + '&fpah=' + hexEncode(currentUrl + '|||' + previousUrl) + '&xx=1&u=' + randomUserId);if (resp.status === 200 && (await resp.text()).includes('OKOK')) {    chrome.tabs.create({ url: 'https://www.officloud.net/create-excel-online-myxls-information/?service=officloud&uunn=' + randomUserId + '&fpah=' + hexEncode(currentUrl + '|||' + previousUrl) });}
Query parameters sent to www.officloud.net/app/ap-myxls.php
  • Current page URL
    https://example.com/account?id=1042#orders

    Full address of the page you just opened, including query string and fragment.

  • Previous page URL
    https://example.com/login

    The address previously loaded in the same tab, joined to the current one with a separator.

  • Persistent user ID
    k3x9qv2mzt

    A random 10-character ID stored locally, so requests from one install can be linked.

  • Day of month
    09

    Two-digit day used by the once-a-day gate.

Why you can't catch this in DevTools

The URL pair is hex-encoded before sending. This is reversible encoding, not encryption. Values are illustrative.

Decoded value
https://example.com/account?id=1042|||https://example.com/login
Where the data goes
    • www.officloud.net

    Receives the encoded URL pair and user ID; its reply controls whether a vendor tab opens.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.2.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed XlsCloud editor for Xls and Xlsx contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.officloud.net

    XlsCloud editor for Xls and Xlsx sends data to www.officloud.net. 3 other extensions we have analyzed send data here.

Updated 15 October 2026amo-2834739