Is Gimp online - image editor and paint tool safe?
We analyzed Gimp online - image editor and paint tool version 3.0.5's actual code and gave it a 35/100 trust score. Avoid this extension unless you accept…
Bottom line
Avoid this extension unless you accept automatic, persistent sharing of your browsing URLs with its service.
What it can access
It requests storage and broad tab visibility, then reports full browsing URLs, including local-network addresses, beyond what image editing needs.[Q1][Q12][Q19]
Security weaknesses
Automatic reporting lacks per-page approval and can expose sensitive URL contents or private-network addresses to the service.[Q8][Q14][Q19]
Signs of misuse
The extension continuously tracks full browsing URLs and links them over time with a persistent username without a necessary editing action.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs and storage. Storage is needed for settings/session identity, but tabs exposes every tab's URL even though basic online image editing does not require continuous whole-browser observation.
Declares a background worker and the storage and tabs permissions. — manifest.json:19-24
Uses tabs.get plus onActivated and onUpdated listeners to inspect tab URLs across the browser. — websecure.js:4-40
Which websites can it run on, and can it read or change what appears on those pages?
It can read the complete URL of every HTTP(S) tab and reports it remotely. It does not inject code into sites or read their page, text, forms, or image data directly.
Retrieves each tab object, selects non-OffiDocs HTTP URLs, and passes the URL to extractimage. — websecure.js:4-23
Defines no content_scripts or host_permissions, so page-body access is not present in the package. — manifest.json:1-26
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content script is declared, and the first-party logic operates on tab.url rather than webpage DOM values. — manifest.json:1-26
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It does not use Chrome's history or cookie services, but its tab listeners create an equivalent server-side browsing-URL history linked to a persistent username.
Observes tab activation/updates and sends each qualifying URL to OffiDocs with the stored username. — websecure.js:31-40, 70-107
Fetches the retained list of previously browsed pages from OffiDocs for display in the popup. — popup.js:67-117
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The bundled remote file manager lets the user select and upload local files to OffiDocs and manage them there. It has no clipboard, camera, microphone, location, screen-capture or native-app access.
Configures an OffiDocs elFinder connector with upload, open, download, copy, delete, rename, archive and extraction controls. — popup.js:236-275
Declares only storage and tabs, omitting media, clipboard, geolocation, capture and nativeMessaging permissions. — manifest.json:22-24
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends complete browsing URLs and a persistent username to OffiDocs automatically; user-selected image/file contents are also transferred to OffiDocs when the online editor or file manager is used.
GETs checkdownloadgimp_h_z_2_nav.php with the hex-encoded full URL and persistent username. — websecure.js:70-107
Points the upload-capable file manager at www.offidocs.com/phpextensions/connector.php with the user's session identifiers. — popup.js:244-275
Does it download or run code, settings, or instructions supplied by a remote server?
OffiDocs returns the retained page list, image-scan results, editor instance and file-manager service identifier. These responses change displayed links and service routing but do not download JavaScript.
Parses OffiDocs history/service responses and uses the returned service host value to build the embedded remote editor URL. — popup.js:70-112, 192-229
Places the OffiDocs image-scan HTML response into the popup result area after minor string replacement. — popup.js:326-351
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
URL collection starts enabled and occurs automatically whenever a tab activates or updates. The popup discloses the behavior and provides a toggle, but no per-page user action is required before transmission.
Automatically observes tab events, defaults offidocscloud to "1", and immediately reports URLs unless the setting is "0". — websecure.js:28-40, 81-106
Shows the Detect files checkbox and a footer stating that browsed URLs are gathered on OffiDocs servers. — index.html:76-82, 133
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings override, search provider, proxy, privacy, management or debugger access. — manifest.json:1-26
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party code is readable, while old minified jQuery, jQuery UI and elFinder libraries form most executable code. No packed or encrypted first-party data was found.
Lists large minified packaged jQuery UI, elFinder and jQuery files alongside small readable first-party popup and worker scripts. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The legacy datepicker's _attachDatepicker calls eval(attrValue) for date:* element attributes. — js/jquery-ui.min.js:7
The legacy parseJSON implementation uses new Function only when native window.JSON.parse is unavailable. — js/jquery.min.js:2
Does it track the websites, pages, searches, or links you visit?
It continuously reports full HTTP(S) URLs from tab activation and update events to OffiDocs. Only URLs containing the special ?xtr marker are truncated; ordinary paths, queries and fragments remain.
Reads tab.url on activation/update and forwards each new non-OffiDocs HTTP URL. — websecure.js:4-23, 31-40
Preserves the entire URL except for the literal ?xtr case, hex-encodes it, and sends it to the OffiDocs collection endpoint. — websecure.js:10-18, 104-107
Does it create a persistent ID or browser fingerprint to recognize you?
A random 10-character username is persisted and attached to URL history, image scans, editor sessions and cloud file-manager requests, linking activity over time.
Loads or creates a random username and stores it with the default-enabled collection setting. — popup.js:4-34
Reuses the stored username as the u parameter on each reported tab URL. — websecure.js:70-107
Does it send cookies, session details, authentication data, or page contents elsewhere?
Complete URLs—including potentially sensitive path/query/fragment values—and selected files are sent to OffiDocs. I found no cookie, password or form-field upload beyond data that may already be embedded in a URL.
Uses the complete tab URL and reversible bin2hex encoding in an OffiDocs request. — websecure.js:4-18, 104-120
Configures remote OffiDocs cloud-file operations, including explicit upload and download. — popup.js:244-275
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content script or relevant media/clipboard/capture permission exists. — manifest.json:1-26
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses server-returned service values in editor iframe and file-manager connector URLs. — popup.js:192-218, 244-275
Assigns OffiDocs responseText to listfilesx.innerHTML after adding a CSS class to anchor tags. — popup.js:326-340
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No host-page content script exists. — manifest.json:1-26
Server-provided links are displayed only inside the extension popup's scan-results area. — popup.js:326-340
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, webRequest, declarativeNetRequest, debugger or downloads permission. — manifest.json:22-24
Can it communicate with software on the computer or services running on localhost?
Any activated or updated HTTP(S) localhost, loopback or private-network URL is eligible for remote reporting, potentially exposing internal hostnames, ports, paths and tokens. It does not control native applications.
The filter accepts every URL containing http unless it contains offidocs; it has no localhost, loopback or private-network exclusion. — websecure.js:4-23
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
bin2hex converts the tab URL to hex solely for the filepath request parameter. — websecure.js:104-120
Image-scan response HTML is displayed in the popup; no response is passed to the legacy library execution sinks. — popup.js:326-340
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable, web_accessible_resources or content_scripts entries. — manifest.json:1-26
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses the same URL filter for all users and checks only whether collection has been disabled. — websecure.js:4-23, 81-106
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is limited to tab observation, local setting/identifier access and one OffiDocs URL-report request per changed tab URL. — websecure.js:1-124
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or host-page injection capability is declared. — manifest.json:1-26