Is Telegram desktop online safe?
We analyzed Telegram desktop online version 1.2.1's actual code and gave it a 35/100 trust score. This extension presents high privacy and security risk…
Bottom line
This extension presents high privacy and security risk because it monitors browsing, reports selected URLs, and accepts remote decisions that can redirect tabs.
What it can access
It can observe broad browsing navigation and send matching full URLs with a persistent code, exceeding a narrowly focused Telegram feature.[Q1][Q12][Q6][Q13]
Security weaknesses
Remote responses control what URLs are monitored and can trigger redirects, while initialization repeatedly re-enables monitoring.[Q7][Q16][Q22]
Signs of misuse
The extension reports selected browsing URLs and a persistent code to its service, with no clear feature need, and remote responses can redirect matching pages.[Q6][Q12][Q13][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and webNavigation. Storage supports its identifier and settings, while webNavigation gives it visibility into top-level browsing well beyond simply opening Telegram.
Declares a background worker with storage and webNavigation permissions. — manifest.json:19-25
Registers a webNavigation listener for any host containing a dot. — runapps.js:25-94
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or host permissions. — manifest.json:4-25
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Uses navigax.url and frame/transition metadata without accessing page content. — runapps.js:54-89
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a persistent random identifier, an enable flag, the last remote-list fetch time, and the remotely supplied URL fragments.
Persists archiveData, lfTime, mruop, and uuyy in chrome.storage.local. — runapps.js:30-50,100-114
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests only storage and webNavigation. — manifest.json:22-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
When a visited URL contains a remote keyword, it sends the complete URL in reversible hexadecimal plus the persistent identifier to RunApps. Query strings and embedded tokens would be included.
Matches navigax.url, appends a marker, hex-encodes the full string, and sends it with uuyy to atelegramva.php. — runapps.js:13-21,63-83,118-120
Does it download or run code, settings, or instructions supplied by a remote server?
RunApps supplies the list of URL fragments that activates reporting. The package applies any nonempty semicolon-separated values without an allowlist or signature check.
Downloads archive-list.php, stores its text, parses it into keywords, and tests each navigation URL against them. — runapps.js:30-50,67-83
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
URL monitoring and remote-list refresh run automatically in the background. A menu calls it 'Online file detection,' but both background startup and popup load reset the setting to enabled.
Starts the listener automatically and writes mruop=1 during initialization. — runapps.js:25-50,100-114
Shows the only user-facing label for the monitoring toggle. — go.html:18-26
Reads the toggle and then writes mruop=1 again when the popup loads. — js/custom.js:24-57
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Builds a RunApps redirect URL and passes it to chrome.tabs.update after the server response contains 1302. — runapps.js:118-128
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses straightforward functions, URLs, storage keys, and control flow. — runapps.js:1-132
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Treats remote responses as keyword text and numeric decision text, not JavaScript. — runapps.js:1-132
Does it track the websites, pages, searches, or links you visit?
It observes every top-level navigation URL, then checks the full URL against remotely controlled fragments. It does not read previously stored browser history.
Registers an all-host webNavigation.onCommitted listener and assigns navigax.url to the matching logic. — runapps.js:25-29,54-94
Does it create a persistent ID or browser fingerprint to recognize you?
It generates a persistent 10-character identifier and includes it with reported URLs and remote-service links. The identifier is not tied to a disclosed account in the packaged UI.
Creates uuyy, stores it locally, and sends it with matched URLs. — runapps.js:3-10,100-120
Reuses uuyy in embedded and external RunApps service URLs. — js/custom.js:31-40,63-107
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Loads the RunApps service in a cross-origin iframe after a user click. — js/custom.js:63-85
Requests no cookies permission. — manifest.json:22-25
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Has no content script or capture/input permission. — manifest.json:4-25
The background listener receives navigation metadata only. — runapps.js:25-94
Can a website or remote server send commands that make the extension take actions?
RunApps can remotely choose which browsing URLs are reported and can decide whether a matching navigation is redirected. The mechanism is active; a malicious current redirect was not demonstrated.
Two server responses control URL matching and the conditional tab update. — runapps.js:30-50,67-83,118-128
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Constructs rtelegramva.php with the encoded original URL and uuyy, then calls chrome.tabs.update. — runapps.js:118-128
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes automatic requests to RunApps for matching rules and URL decisions. It does not configure a proxy or inspect response bodies from unrelated sites.
Fetches archive-list.php and atelegramva.php from the background worker. — runapps.js:30-51,118-128
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-system capability. — manifest.json:22-25
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote text selects monitored URLs and can trigger a redirect. — runapps.js:30-50,67-83,118-128
Loads RunApps pages in an iframe or separate tab after user actions. — js/custom.js:63-107
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or externally_connectable section. — manifest.json:4-25
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
A local toggle nominally controls URL matching, but initialization repeatedly writes it back to enabled. Remote keyword and decision responses also change behavior without a durable user control.
Checks mruop before matching but resets mruop to 1 during worker initialization. — runapps.js:63-85,100-114
Displays a checkbox and saves changes, while also resetting mruop to 1 when the popup initializes. — js/custom.js:24-57
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs lightweight navigation checks, storage operations, and network requests only. — runapps.js:1-132
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates a cross-origin iframe and external tabs but performs no form or input mutation. — js/custom.js:63-107