Is Talk & Comment: Voice Notes & Audio Feedback safe?
We analyzed Talk & Comment: Voice Notes & Audio Feedback version 4.5.1's actual code and gave it a 78/100 trust score. This is a legitimate voice-note…
Bottom line
This is a legitimate voice-note extension with broad webpage access and notable collection, but no established malicious abuse.
What it can access
It runs on every webpage, records microphone audio after user action, and writes share links to the clipboard; this fits its purpose but is broader than a single-site feature. [Q1][Q2][Q5]
Security weaknesses
The extension runs on every webpage and accepts server-controlled settings, but privileged messages are origin-restricted and downloaded content is not executable. [Q2][Q7][Q16][Q20]
Signs of misuse
It sends recordings, page addresses, identity data, and listening measurements to its service for feature operation; no evidence shows unrelated collection or browser-session theft. [Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks to run on every webpage and requests microphone-supporting offscreen access, tabs, windows, storage, notifications, clipboard writing, alarms, and request-header rules; most support its recorder, player, account, and upload features, but the scope is broad.
Declares an all-URL content script, broad web-accessible resources, clipboardWrite, storage, offscreen, tabs, windows, notifications, declarativeNetRequest, alarms, and Talk & Comment/telemetry host access. — manifest.json:14-105
Uses the offscreen document to request microphone audio for a recording initiated from a tab. — offscreen.js:543-620
Which websites can it run on, and can it read or change what appears on those pages?
Its content code runs on every URL, adds a floating recorder, observes page changes, and replaces recognized Talk & Comment links with inline players; it does not generally harvest page text.
Loads the content-script module at document_end on <all_urls>. — manifest.json:69-78
Mounts a shadow-DOM recorder UI, observes added nodes, recognizes Talk & Comment links, and injects packaged inline players. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Input, textarea, role=textbox, and contenteditable selectors are used as exclusion zones for inline-player insertion rather than as data sources. — assets/content-v3.tsx-CjVvQ9Yn.js:1
The activeElement references come from bundled React focus/selection restoration code, not collection of form contents. — assets/client-IzizzUdG.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The declared permissions omit cookies, history, bookmarks, and downloads. — manifest.json:88-105
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It records microphone audio after permission and can write a finished share link to the clipboard; it does not read the clipboard, access files, camera, location, screen capture, or native apps.
Calls getUserMedia for audio and creates a MediaRecorder after the recording workflow begins. — offscreen.js:543-692
Uses navigator.clipboard.writeText, with a hidden textarea copy fallback, to copy a generated voice-note link. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends recorded audio, the current page URL during eligibility checks, account or anonymous identifiers, installation credentials, product events, and playback measurements to Talk & Comment.
POSTs sound_file, user_hash, source, and recording length to /api/v3/tracks; the permission check adds the complete source URL and user ID to /api/v3/user_status/check_recording_permission. — assets/service-worker.js-CK23UmBK.js:1
Creates impression/session UUIDs and reports the track ID, listening seconds, and timestamps through the service worker. — playback-telemetry.js:89-118
Does it download or run code, settings, or instructions supplied by a remote server?
The service downloads account limits, floating-recorder settings, voice-note URLs, transcripts, and other data that changes extension behavior or display, but it does not download executable code.
Fetches server recording permission and /api/v3/settings/floater, then broadcasts whether the floating recorder should be initialized or destroyed. — assets/service-worker.js-CK23UmBK.js:1
Uses server-provided audio URL, player URL, transcript, and transcription status as constrained application data. — read-along.js:158-207
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically injects its UI, scans page mutations for its own voice-note links, syncs settings, and reports some lifecycle events, but recording and microphone prompts require a clear user action.
Initializes the floating UI and inline-player observer automatically on content-script load. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Rejects untrusted clicks and calls getUserMedia only from the permission button workflow. — permissions.js:153-218
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no chrome_settings_overrides, search provider, proxy, privacy, management, or debugger capability. — manifest.json:1-114
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Several first-party application and third-party React/Sentry bundles are minified, but names, services, messages, and security-relevant data flows remain traceable and there is no packed or encrypted data.
Lists minified content, service-worker, client, React, and Sentry bundles among 55 package files. — inventory.json:1
The minified worker retains descriptive endpoint, message, permission, upload, and telemetry strings. — assets/service-worker.js-CK23UmBK.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads only the packaged service-worker module with a static import. — service-worker-loader.js:1
Dynamically imports a fixed chrome.runtime.getURL path to the packaged content module, not a remote URL. — assets/content-v3.tsx-loader-CIP_M6PE.js:82-89
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads the initiating tab URL and places it unredacted in the source query parameter for check_recording_permission. — assets/service-worker.js-CK23UmBK.js:1
Captures the page title and URL when recording starts for local finished-recording UI state; no continuous page-view sender was found. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It maintains persistent account or anonymous user IDs, an installation ID/token, an analytics client ID, and a separate playback visitor ID; per-play session UUIDs are also generated.
Creates or reuses anonymous_user_id/user_hash, uid, installation credentials, and authenticated user identity for API and analytics requests. — assets/service-worker.js-CK23UmBK.js:1
Generates UUIDs for voice-note impressions and listening sessions. — playback-telemetry.js:19-27
Does it send cookies, session details, authentication data, or page contents elsewhere?
Recorded audio, the source page URL, and account or anonymous identity data are sent to the service; authentication tokens are used in headers for authenticated requests but are not sent to unrelated sites.
Uploads audio to /api/v3/tracks and adds access-token/client/uid or anonymous/installation credentials to Talk & Comment API requests. — assets/service-worker.js-CK23UmBK.js:1
Production API and web bases are fixed to https://talkandcomment.com. — assets/config-BA__Eimj.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It captures microphone audio and can write the resulting link to the clipboard, but does not watch keystrokes, read form entries, read clipboard contents, or take screenshots.
Obtains an audio MediaStream and records it with MediaRecorder. — offscreen.js:602-692
Copies only the generated share text through clipboard.writeText or execCommand('copy'). — assets/content-v3.tsx-CjVvQ9Yn.js:1
Can a website or remote server send commands that make the extension take actions?
Allowlisted Talk & Comment pages can send origin-checked auth, settings, microphone, and recording commands through a page bridge, and the Talk & Comment server can sync the floater setting; ordinary unrelated sites do not receive that control.
The SPA message bridge checks event.source, a fixed message source marker, and an allowlisted Talk & Comment origin before forwarding privileged actions. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Limits the embedded permission bridge to extension, Talk & Comment/tac subdomains, or the explicit localhost development origin. — permissions.js:13-28
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It detects links to its own voice-note service and replaces or augments them with inline players; it does not modify ads, affiliate codes, shopping carts, or search results.
Observes added DOM nodes, identifies Talk & Comment voice-note URLs, and inserts packaged player elements near them. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
A declarative rule adds the extension services token and build headers only to Talk & Comment services requests initiated by Talk & Comment origins; it does not proxy, redirect, or inspect arbitrary browsing traffic.
Creates rule 9001 with a regex restricted to the configured API host and /api/v3 path, allowlisted initiator domains, and fixed request headers. — assets/service-worker.js-CK23UmBK.js:1
Requests declarativeNetRequest but not proxy, downloads, webRequest, or webRequestBlocking. — manifest.json:88-105
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Sets ENV to production and only loads custom backend overrides when ENV is not production. — assets/config-BA__Eimj.js:1
Allows localhost only to embed the packaged permissions page; localhost is not a production host_permission and nativeMessaging is absent. — manifest.json:40-51
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads a fixed packaged module directly; recovery handling only shows a refresh banner for failed package imports. — assets/content-v3.tsx-loader-CIP_M6PE.js:82-89
Remote responses are parsed as JSON, URLs, settings, auth data, or media metadata rather than executable source. — assets/service-worker.js-CK23UmBK.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes packaged UI/player resources but declares no externally_connectable entry. — manifest.json:14-64
Privileged SPA messages require an allowlisted Talk & Comment origin; a public transcribe custom event can only open a Talk & Comment library URL for a supplied track ID. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Host-specific rules disable inline players or global styles on known incompatible pages such as Notion rather than enabling hidden capabilities. — assets/content-v3.tsx-CjVvQ9Yn.js:1
Server gates cover quotas, authentication, transcription/review features, and floater visibility. — assets/service-worker.js-CK23UmBK.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The main intensive loop computes a small microphone waveform at 20 FPS only while recording. — offscreen.js:443-469
Background work is recording coordination, upload retry/recovery, settings/auth sync, and bounded analytics. — assets/service-worker.js-CK23UmBK.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Treats input, textarea, contenteditable, and role=textbox elements as no-player zones and only writes generated share text to the clipboard. — assets/content-v3.tsx-CjVvQ9Yn.js:1