Is XlsWork XLS editor for spreadsheets safe?

Medium risk

XlsWork sends the URL of every web page you visit, hex-encoded with a per-install ID, to stream.redcoolmedia.net.

On each tab activation or update, the background script reads the tab's full URL, including query string, and sends it to stream.redcoolmedia.net along with a random ID stored in the browser. The server's reply can also trigger a redirect of the tab to a redcoolmedia.net page that carries the visited URL and ID, though the code path may not run in this build.

RedCoolMediav1.8.7Firefox Add-ons
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sends every page address you visit to stream.redcoolmedia.net with an install ID

Code analysis shows the extension sends the full address of each web page you open, hex-encoded with a per-install ID, to stream.redcoolmedia.net.

This happens on every tab switch or page update.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You switch to a tab or a page finishes updating.

Applies to any address containing 'http' that does not contain 'redco'.

The extension did this

The extension requests stream.redcoolmedia.net with your page address encoded in the query string.

The address is only skipped if it equals the last one sent.

Values placed in the request to stream.redcoolmedia.net/api/xlsworku.php
  • Page address (l)
    68747470733a2f2f6578616d706c652e636f6d2f6163636f756e743f69643d3432

    The full address of the page you are on, including any query string, written as hexadecimal text.

  • Encoding flag (hex)
    1

    Tells the server the address is hex-encoded.

  • Install ID (u)
    k3x9qm2ab7

    A random 10 character ID kept in local storage, letting the server link visits from one install.

The code that does this

Tab listener and outbound request in web.js

Readable version

URL filter before sending

web.js
function xdii(tabId) {      chrome.tabs.get(tabId, function(tab) {                      if ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) )  {                    utyu =  tab.url;                    rtcc = "";                    rtcc =   utyu;                      exx(rtcc);                    lasiee = tab.url;            }      });}

Hex encoder

web.js
function bin2hex (bin){  var i = 0, l = bin.length, chr, hex = '';  for (i; i < l; ++i)  {    chr = bin.charCodeAt(i).toString(16)    hex += chr.length < 2 ? '0' + chr : chr  }  return hex}
Where the page addresses go
    • stream.redcoolmedia.net

    Receives the hex-encoded page address and install ID on each tab event; its reply can trigger a redirect.

    • www.redcoolmedia.net

    Target of a tab navigation carrying the page address and ID when the server reply contains '302'.

Check if you're affected

Decodes the hex 'l' parameter from stream.redcoolmedia.net requests found in proxy logs.

Requires
  • Python 3
decode_redcool_url.py · py
import sysfrom urllib.parse import urlparse, parse_qsfor line in sys.stdin:    line = line.strip()    if 'stream.redcoolmedia.net/api/xlsworku.php' not in line:        continue    q = parse_qs(urlparse(line).query)    l = q.get('l', [''])[0]    print(bytes.fromhex(l).decode('utf-8', 'replace'), q.get('u', [''])[0])
How to run it
  1. 1Export proxy log URLs, one per line.
  2. 2Run: python3 decode_redcool_url.py < urls.txt.
  3. 3Each output line is the visited page address and the install ID.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.8.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed XlsWork XLS editor for spreadsheets contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.redcoolmedia.net

    XlsWork XLS editor for spreadsheets sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.

  • stream.redcoolmedia.net

    XlsWork XLS editor for spreadsheets sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.

Updated 15 October 2026amo-822595