Is Presentation editor PPTWork for PPT slides safe?

Medium risk

PPTWork sends every top-level page URL you visit, with the previous URL, to redcoolmedia.net.

On each page navigation the extension hex-encodes the current URL, the tab's previous URL and a random per-install ID, and requests them from www.redcoolmedia.net. Query strings are not removed. If the server replies with a particular token, the extension opens a new tab on a redcoolmedia.net page carrying the encoded visited URL. A settings checkbox controls this and is on by default.

RedCoolMediav1.9.6Firefox Add-ons
51Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Document viewer sends every page you open, hex-encoded, to redcoolmedia.net

Code analysis shows each page address you open, plus the tab's previous address and an install ID, is hex-encoded and sent to www.redcoolmedia.net.

This is unrelated to opening documents.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You navigate to any web page in a tab.

The listener matches every host containing a dot.

The extension did this

The extension sends that URL and the tab's previous URL to www.redcoolmedia.net.

The values are hex-encoded and sent with a per-install ID.

Values placed in the request to chk-pptwork-x.php
  • Current page URL
    https://mail.example.com/inbox?token=abc123

    The full address of the page you just opened, including any query string.

  • Previous page URL
    https://www.example.org/search?q=invoice

    The address previously loaded in the same tab, so navigation paths can be rebuilt.

  • Install ID
    k3x9a7qw2d

    A random 10-character ID stored on first use, linking all requests from one browser.

  • Day of month
    09

    Two-digit day used to limit repeat sends once the server has replied.

The code that does this

Navigation listener and the outbound request

Readable version

The extension is not minified; the source is shown as shipped. Every navigation passes current|||previous to xnav().

web.js
xnav(currentUrl + '|||' + previousUrl)  // GET www.redcoolmedia.net/api/chk-pptwork-x.php?url=<hex>&hex=1&u=<installId>
Where the data goes
    • www.redcoolmedia.net

    Receives hex-encoded URL pairs and the install ID; the same operator that ships this extension.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.9.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Presentation editor PPTWork for PPT slides contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    Presentation editor PPTWork for PPT slides sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

Updated 15 October 2026amo-844011