Is Video editor VideoStudio safe?

Medium risk

Video editor VideoStudio sends the URL of each web page you visit, hex-encoded, to stream.redcoolmedia.net.

When you switch to or load an http(s) tab, the extension reads the page address, including query strings, and sends it with a persistent random user ID to stream.redcoolmedia.net. This is on by default and can be turned off with a checkbox on the settings page. The extension is described as a video editor, which does not need your browsing addresses.

RedCoolMediav1.8.7Firefox Add-ons
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Video editor sends every page URL you visit, hex-encoded, to redcoolmedia.net

Code analysis shows the background script sends each visited http(s) page URL, hex-encoded with a persistent random ID, to stream.redcoolmedia.net.

A settings checkbox, on by default, is the only opt-out.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You switch to a tab or a page finishes loading in your browser.

The extension did this

The extension sends the page address, hex-encoded, with a persistent ID to stream.redcoolmedia.net.

The code that does this

Tab listeners and the outbound request in web.js

Readable version

Tab listeners

web.js
var usernameredcool = ""; let aati, lasiee;function xdii(tabId) {      chrome.tabs.get(tabId, function(tab) {                      if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) )  {                    utyu =  tab.url;                    rtcc = "";                    rtcc =   utyu;                      exx(rtcc);                    lasiee = tab.url;            }      });}function web() {    this.init = function () {                chrome.tabs.onActivated.addListener(function(activeInfo) {                aati = activeInfo.tabId;                xdii(aati);        });        chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {                    xdii(tabId);        });         };}

Outbound request

web.js
     let rtcx =  await fetch('https://stream.redcoolmedia.net/api/videostudiou.php?l=' + bin2hex(urly) + '&hex=1&u=' + un);                              let dsx = await rtcx.text();              console.log(dsx);                var rse2 = dsx;              if ( rse2.indexOf("302") !== -1 )   {                       var cvcv = 'https://www.redcoolmedia.net/api/app-videostudio.php?url=' + bin2hex(urly) + '&u=' + un;                       //chrome.tabs.create({ url: cvcv });                       chrome.tabs.update(chrome.tabs.getCurrent().id, {url: cvcv});             }
Query parameters on the request
  • Page address (l)
    68747470733a2f2f6578616d706c652e636f6d2f6163636f756e743f69643d3432

    Full URL of the tab, including query string, as plain hex.

  • Encoding flag (hex)
    1

    Tells the server the address is hex-encoded.

  • Visitor ID (u)
    k3x9q0wz1m

    Random 10-character ID created once and stored locally.

Destinations in the code
    • stream.redcoolmedia.net

    Receives the hex-encoded page URL and visitor ID on every qualifying tab event.

    • www.redcoolmedia.net

    Target of a redirect if the response text contains '302'.

When this fires

On an interval

Fires on each tab activation or update to a new http(s) URL; no timer, no batching.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.8.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Video editor VideoStudio contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • stream.redcoolmedia.net

    Video editor VideoStudio sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.

Updated 15 October 2026amo-836947