Is Audio editor & music editor AudioStudio safe?

Medium risk

AudioStudio sends the full URL of every web page you visit, hex-encoded with a persistent ID, to stream.redcoolmedia.net.

On each tab switch or page load, the background script reads the tab's http(s) URL, including query strings, and sends it to stream.redcoolmedia.net along with a random 10-character user ID stored locally. The popup has an opt-out checkbox that is on by default. If the server reply contains '302', the code also tries to navigate a tab to a redcoolmedia.net page carrying the visited URL, though that call may not work as written.

RedCoolMediav1.8.9Firefox Add-ons
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Audio Studio sends the address of every page you visit to redcoolmedia.net

Code analysis shows each http(s) tab URL, hex-encoded with a persistent random ID, is sent to stream.redcoolmedia.net on every navigation.

Query strings are included.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You switch to a tab or load a page with an http(s) address.

The extension did this

The extension sends that full address, hex-encoded, to stream.redcoolmedia.net.

Requests repeat whenever the URL differs from the last one sent.

Query parameters sent on each navigation
  • l
    68747470733a2f2f6578616d706c652e636f6d2f3f713d74657374

    Hex encoding of the full visited URL, including query string.

  • hex
    1

    Flag stating the URL value is hex-encoded.

  • u
    k3x9qpw2ma (illustrative)

    Persistent random 10-character ID stored locally and reused across visits.

The code that does this

Navigation listeners and the outbound request

Readable version

Reading

web.js
// On tab activation or update, read the tab URL.// Skip URLs containing 'redco' or lacking 'http'; skip repeats of the last URL.// Pass the URL to exx().

Sending

web.js
// Unless the stored redcoolonline flag is "0" (popup opt-out),// GET https://stream.redcoolmedia.net/api/audiostudiou.php//   ?l=<hex of full URL>&hex=1&u=<persistent random ID>
Where the data goes
    • stream.redcoolmedia.net

    Receives the hex-encoded visited URL and persistent ID via audiostudiou.php.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.8.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Audio editor & music editor AudioStudio contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    Audio editor & music editor AudioStudio sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

  • stream.redcoolmedia.net

    Audio editor & music editor AudioStudio sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.

Updated 15 October 2026amo-826785