Is Image editor PaintMagick for photos safe?

Medium risk

PaintMagick sends the URL of every HTML, XML and image page you open to redcoolmedia.net.

On each navigation to a page ending in .html or .xml, the extension strips the query string, hex-encodes the URL and sends it to www.redcoolmedia.net, which can reply to open a vendor tab. Direct image URLs (png, jpg, gif and similar) are sent the same way to a second endpoint, which can open the vendor's online editor. A random per-install ID is stored and the HTML/XML check runs once per day.

RedCoolMediav1.3.3Firefox Add-ons
51Risk
Who publishes it

RedCoolMedia - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RedCoolMedia
Website
www.redcoolmedia.net/index.php/web-online-images-apps/paintmagick-image-editor-online-for-photos

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

PaintMagick sends the URL of every .html or .xml page you open to redcoolmedia

Code analysis shows page addresses ending in .html or .xml are hex-encoded and sent to redcoolmedia.net; a reply containing OKOKOK opens a new tab on that site.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page whose address ends in .html or .xml.

This applies on all http and https sites.

The extension did this

The extension sends the page address, hex-encoded, to redcoolmedia.net.

If the reply contains OKOKOK it opens a tab on that site.

The code that does this

Navigation filter and URL request

Readable version

Filter and query stripping

web.js
if ( ( b14.indexOf(".xml") > 0 ) ||     ( b15.indexOf(".html") > 0 ) ){    if ( g3.indexOf('?') >= 0 ) {        g3 = g3.substring(0, g3.indexOf('?'));    }    xnav(g3);}

Request and reply handling

web.js
let responsecheck = await fetch('https://www.redcoolmedia.net/api/chk-paintmagick.php?dx=' + d1x + '&url=' + bin2hex(g3x) + '&hex=1');if (responsecheck.status === 200) {    let d2check = await responsecheck.text();    var response2 = d2check;    if ( response2.indexOf("OKOKOK") !== -1 )   {        await seredtd(response2.substring(0,2));        var newURL = 'https://www.redcoolmedia.net/api/app-paintmagick.php?url=' + bin2hex(g3x);        chrome.tabs.create({ url: newURL });    }}
Query parameters sent to chk-paintmagick.php
  • Page address
    68747470733a2f2f6578616d706c652e636f6d2f696e6465782e68746d6c (https://example.com/index.html)

    The address of the page you opened, without its query string, hex-encoded.

  • Day of month
    09

    Two-digit day used to limit the check to once per day.

  • Hex flag
    1

    Tells the server the address is hex-encoded.

Where the data goes
    • www.redcoolmedia.net

    Receives the encoded page address and can return OKOKOK to trigger a new tab.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.3.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Image editor PaintMagick for photos contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    Image editor PaintMagick for photos sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-958144