Is Video converter online VideoConvertPlus safe?
Video converter online VideoConvertPlus reports every .html/.xml page you visit to its vendor's server and can open a new tab in response.
In the background, the extension watches every page navigation across all sites and, once per day, sends the visited URL (hex-encoded, query string stripped) along with a persistent per-install ID to the vendor's own server. If that server's reply contains a specific code, the extension automatically opens a new browser tab to a vendor-chosen page, without any click from the user. A settings checkbox labeled 'Edit Online' can turn this off, but it does not explain that it controls background URL reporting, and it is on by default.
Who publishes itRedCoolMedia - no other listings under this identity
RedCoolMedia - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Visiting any .html or .xml page reports the URL to redcoolmedia.net
Code analysis shows the extension reports the URL of every .html or .xml page you visit, on any site, to the vendor's own server, without a prompt or a listed privacy notice.
You open any webpage whose path ends in .html or .xml.
The listener matches on any host, so this fires on ordinary browsing, not just the vendor's own site.
The background script hex-encodes the visited URL and sends it to the vendor's own server automatically.
No click, popup interaction, or confirmation is required; a day-counter in storage limits this to the first matching page per calendar day.
The navigation listener and the beacon function (web.js)
chrome.webNavigation.onCommitted.addListener(function(details) {
const committedUrl = details.url;
if (!committedUrl || committedUrl.includes('redcool')) return;
let lastSegment = committedUrl.substring(committedUrl.lastIndexOf('/') + 1).split('?')[0].toLowerCase();
const endsWithXml = lastSegment.endsWith('.xml');
const endsWithHtml = lastSegment.endsWith('.html');
if (!endsWithXml && !endsWithHtml) return;
const urlWithoutQuery = committedUrl.split('?')[0];
reportVisitedPage(urlWithoutQuery); // calls xnav()
}, { url: [{ hostContains: '.' }] }); // matches every hostasync function reportVisitedPage(visitedUrl) {
const dayCode = new Date().toLocaleString('default', { day: '2-digit' });
const alreadySentToday = !(await dayCounterChanged(dayCode));
if (alreadySentToday) return;
const response = await fetch(
`https://www.redcoolmedia.net/api/chk-videoconverter.php?dx=${dayCode}&url=${hexEncode(visitedUrl)}&hex=1`
);
const body = await response.text();
if (body.includes('OKOKOK')) {
await saveDayCounter(body.substring(0, 2));
chrome.tabs.create({
url: `https://www.redcoolmedia.net/api/app-videoconverter.php?url=${hexEncode(visitedUrl)}`,
});
}
}| Field | Value | Why it matters | |
|---|---|---|---|
Visited page URL | 68747470733a2f2f6578616d706c652e636f6d2f626c6f672f686f772d746f2d636f6e766572742d6d70342e68746d6c | The full address of the page you just loaded, query string removed, reversibly hex-encoded so it reads as random text on the wire. | |
Day code | 26 | The current day of the month; used server-side as a once-per-day gate for this install. |
- www.redcoolmedia.net
Receives the hex-encoded URL of every matching page you visit; the same vendor domain also hosts the extension's own video-conversion service.
Hex-decodes the url= query parameter from a captured chk-videoconverter.php request back into the visited page address.
// Usage: node decode_beacon_url.js "68747470733a2f2f6578616d706c652e636f6d2f..."
const hex = process.argv[2];
if (!hex) {
console.error('Pass the hex value of the url= query parameter.');
process.exit(1);
}
const bytes = Buffer.from(hex, 'hex');
console.log(bytes.toString('utf8'));- 1Capture a request to chk-videoconverter.php in devtools or a proxy.
- 2Copy the url= value.
- 3Run: node decode_beacon_url.js <value>.
- 4The visited page address prints in plain text.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.6.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Add items to the right-click menu
contextMenus
Where it sends data
Destinations our analysis observed Video converter online VideoConvertPlus contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.redcoolmedia.net
Video converter online VideoConvertPlus sends data to www.redcoolmedia.net. 6 other extensions we have analysed send data here.