Is DocCloud editor for doc & docx safe?
We analyzed DocCloud editor for doc & docx version 1.2.3's actual code and gave it a 86/100 trust score. This is a narrowly scoped document editor with…
Bottom line
This is a narrowly scoped document editor with limited access and no established abuse, though it sends a persistent pseudonymous identifier to its own service.
What it can access
The extension requests only local storage and no access to webpages, browsing data, files, or device features. [Q1] It sends a persistent pseudonymous identifier to Officloud when the user opens its editor or file manager, creating limited tracking exposure. [Q6] [Q13]
Security weaknesses
No meaningful security weakness was established: it lacks ordinary-webpage access and dynamic code execution. [Q2] No website or remote service was shown to have a command channel into the extension. [Q11] [Q16] [Q21]
Signs of misuse
No evidence shows sensitive-data collection, browsing tracking, or sharing of authentication information. [Q12] [Q14] The persistent identifier is sent to the named document service during user-requested navigation, with no hidden activation found. [Q6] [Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Its only browser permission is local extension storage.
Declares only the storage permission and no host permissions or content scripts. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content script, activeTab, tabs, scripting, or host access. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Only manages its popup, local identifier, and Officloud navigation. — js/ext.js:1-70
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a generated identifier and the Online integration checkbox value in chrome.storage.local.
Reads and writes uunn and myppp under the mofficloudi storage key. — js/ext.js:12-40
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no related permissions. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the generated workspace identifier to Officloud when the user opens the editor or file manager; document traffic then occurs directly within that chosen web service.
Loads or opens officloud.net URLs with username=uunn after user clicks. — js/ext.js:45-68
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All extension behavior and Officloud URLs are packaged locally. — js/ext.js:1-70
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Remote navigation is attached only to popup click handlers. — js/ext.js:45-68
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting permissions. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains straightforward identifier, storage, and click-handler logic. — js/ext.js:1-70
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no dynamic execution primitive. — js/ext.js:1-70
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no tabs or history access. — manifest.json:1
Does it create a persistent ID or browser fingerprint to recognize you?
A stable pseudonymous identifier is generated locally and sent to Officloud as a username; no cross-site tracking was found.
Generates and persists uunn, then appends it to Officloud URLs. — js/ext.js:2-28,45-68
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies or identity permission. — manifest.json:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Has no page or capture access. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The remote editor is isolated in an iframe and no message bridge is registered. — boot.html:67-77
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Changes checkbox state and replaces the popup's own iframe. — js/ext.js:30-52
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It opens and embeds Officloud editor and file-manager pages after user action.
Navigates to officloud.net editor and file-manager URLs. — js/ext.js:45-68
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares storage only. — manifest.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote content remains inside the Officloud webpage or iframe and is not evaluated by extension code. — js/ext.js:1-70
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Registers no message event or runtime message listener. — js/ext.js:1-70
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and toggles myppp but never checks it before opening the remote service. — js/ext.js:17-40,45-68
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains only lightweight popup and navigation logic. — js/ext.js:1-70
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Has no webpage access. — manifest.json:1