Is Movie maker MovieStudio video editor safe?

Medium risk

Movie maker MovieStudio sends the full URL of every web page you visit to stream.redcoolmedia.net.

On each tab switch or page load, the extension sends the complete URL, including path and query string, to stream.redcoolmedia.net. The URL is hex-encoded and sent with a random ID stored in the browser. This is on by default, and the only opt-out is a popup checkbox labelled 'Edit Online'. The server's response can also steer a redirect to redcoolmedia.net.

RedCoolMediav1.4.1Firefox Add-ons
49Risk
Who publishes it

RedCoolMedia - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RedCoolMedia
Website
www.redcoolmedia.net/index.php/web-online-audio-video-apps/movie-maker-moviestudio-video-editor-online

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Redcool Media extension sends every visited page URL to stream.redcoolmedia.net

Code analysis shows each http(s) tab URL is hex-encoded and sent with a persistent random ID to stream.redcoolmedia.net on every tab switch or update.

Collection is on by default.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page or switch to another tab.

Any tab whose address contains http and not redco qualifies.

The extension did this

The extension sends that page address to stream.redcoolmedia.net.

The address is hex-encoded and sent with a random ID stored on your device.

The code that does this

Tab listeners and URL filter that feed the upload

Readable version

Outbound request in exx()

web.js
let rtcx = await fetch('https://stream.redcoolmedia.net/api/moviemakeru.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);                     if (rtcx.status === 200) {              let dsx = await rtcx.text();              console.log(dsx);                var rse2 = dsx;              if ( rse2.indexOf("302") !== -1 )   {                       var cvcv = 'https://www.redcoolmedia.net/api/app-moviemaker.php?url=' + bin2hex(urly) + '&u=' + un;                       // chrome.tabs.create({ url: cvcv });                       chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});             }                                       }
Query parameters on the outbound request
  • l (page address)
    68747470733a2f2f6578616d706c652e636f6d2f6163636f756e742f6f72646572733f69643d3734

    The full address you are viewing, including path and query string, hex-encoded.

  • u (random ID)
    k3x9qd0mzt

    A random ID kept in extension storage, letting visits be linked together over time.

  • hex flag
    1

    Tells the server the address is hex-encoded.

Why you can't catch this in DevTools

The URL is only hex-encoded (character codes in base 16), so anyone can reverse it. Sample value is illustrative.

Decoded value
https://example.com/account/orders?id=74
The code that does this

The encoding routine is plain hex conversion

Readable version
Each character code is written as two hex digits. The result is reversible with any hex decoder.
Where the data goes
    • stream.redcoolmedia.net

    Receives hex-encoded page addresses and the random ID from /api/moviemakeru.php.

    • www.redcoolmedia.net

    Target of a tab redirect carrying the hex URL and ID if the server reply contains 302.

Opt-out and redirect path

Sending is skipped only when the stored redcoolonline value is 0; the default is 1. The 302 redirect calls chrome.tabs.getCurrent() from a background context, which likely returns undefined, so it probably fails; this was not run.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Movie maker MovieStudio video editor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    Movie maker MovieStudio video editor sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

  • stream.redcoolmedia.net

    Movie maker MovieStudio video editor sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.

Updated 15 October 2026amo-851109