Is XPaint image editor and painter safe?

Clean risk

XPaint adds a context-menu item that sends the clicked image to offidocs.com for online editing.

When you right-click an image and choose 'Edit with XPaint online', the extension opens an offidocs.com editor tab with the image URL. For embedded data: images it decodes the bytes and uploads them to offidocs.com over plain, unencrypted HTTP first. It only acts on that explicit click and has no content scripts or host permissions.

officeonlinesystemsv2.7.2resigned1Firefox Add-ons
0Risk
Who publishes it

officeonlinesystems - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 2.7.2resigned1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed XPaint image editor and painter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.offidocs.com

    XPaint image editor and painter sends data to www.offidocs.com. 14 other extensions we have analysed send data here.

Updated 15 October 2026amo-791648