Is Photo editor PhotoStudio for images safe?

Medium risk

Photo editor PhotoStudio sends every http(s) URL you visit to stream.redcoolmedia.net with a persistent random ID.

On each tab activation or update, the background script hex-encodes the full tab URL, including query strings, and sends it with a random 10-character user ID to redcoolmedia.net. Collection is on by default, and only a settings checkbox turns it off. If the server's reply contains '302', the extension also redirects the active tab to a redcoolmedia.net page carrying the visited URL.

RedCoolMediav1.7.7Firefox Add-ons
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every page URL you visit is hex-encoded and sent to stream.redcoolmedia.net

Code analysis shows the extension sends the full address of each web page you open or switch to, hex-encoded with a persistent random ID, to stream.redcoolmedia.net.

It is on by default.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You switch to a tab or a tab navigates to an http or https page.

The extension did this

The extension sends that page's full address, hex-encoded, with your persistent ID to stream.redcoolmedia.net.

Pages whose address contains 'redco', and repeats of the last address, are skipped.

Query parameters sent to the collection endpoint
  • Page address (l)
    68747470733a2f2f6578616d706c652e636f6d2f6163636f756e743f69643d31323334

    The full address of the page you are on, including any query string, in hex form that is easy to decode.

  • Persistent ID (u)
    k3x9q2m7ab

    A random ID stored in the extension, letting visits be linked to one installation over time.

  • Encoding flag (hex)
    1

    Marks the address as hex-encoded.

The code that does this

Listener, URL filter and upload request in web.js

Readable version

Tab listeners and URL filter

web.js
function xdii(tabId) {      chrome.tabs.get(tabId, function(tab) {                      if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) )  {                    utyu =  tab.url;                    rtcc = "";                    rtcc =   utyu;                      exx(rtcc);                    lasiee = tab.url;            }      });}

Upload request

web.js
let rtcx = await fetch('https://stream.redcoolmedia.net/api/photostudiou.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);
The code that does this

Default-on setting and persistent ID in exx()

Readable version
    if ( redxda.usernameredcool ) {        usernameredcool = redxda.usernameredcool;    }    else {        usernameredcool = "" + randomString(10) + "".toLowerCase();        redxda.usernameredcool = usernameredcool;    }    if ( redxda.redcoolonline ) {        redcoolonline = redxda.redcoolonline;    }    else {        redcoolonline = "1";        redxda.redcoolonline = "1";    }
Where the data goes
    • stream.redcoolmedia.net

    Receives the hex-encoded page address and persistent ID on each qualifying tab event.

    • www.redcoolmedia.net

    If the response contains '302', the extension navigates a tab to this host's app-photostudio.php with the same encoded address and ID.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.7.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Photo editor PhotoStudio for images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    Photo editor PhotoStudio for images sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

  • stream.redcoolmedia.net

    Photo editor PhotoStudio for images sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.

Updated 15 October 2026amo-828659