OffiDocs-Linked Browser Extensions Collect Browsing URLs Across Millions of Installs

A security report identified an OffiDocs-linked network of 60 Chrome extensions with approximately 2.3 million installs across four publisher accounts, including 37 extensions reportedly transmitting full browsing URLs without explicit user consent. The extensions, largely everyday office tools, hex-encode URLs and associate them with installation-specific identifiers; some can also redirect browser tabs based on server responses. Shared corporate identifiers, infrastructure, and code link the publishers to Estonia-based OffiDocs Group OÜ, with additional extensions distributed through Firefox, Edge, and China's 360 store.

The report also found that VPNOnline collects URLs matching a remotely controlled keyword list and uses unencrypted HTTP proxy connections despite advertising traffic encryption. Privacy disclosures vary, with some policies allowing sharing with business partners and other third parties, but the ultimate recipients of collected browsing data remain unverified. Chrome Web Store badges lend many extensions an appearance of trustworthiness despite the reported behavior. Security teams should inventory the implicated extensions, assess potential exposure of sensitive URLs, and restrict unapproved browser extensions.