Is Audio Recorder - Record Voice & Tab Sound safe?
We analyzed Audio Recorder - Record Voice & Tab Sound version 2.5's actual code and gave it a 76/100 trust score. This is a generally purpose-aligned…
Bottom line
This is a generally purpose-aligned recorder, but its all-site access and ability to capture audio warrant caution.
What it can access
It can record microphone and tab audio, store recordings, and reach all websites, although conversion uses Qooly and recording is user-started [Q1].
Security weaknesses
All-site access is broader than the demonstrated feature needs, but no exposed path to privileged extension actions was found [Q1][Q21].
Signs of misuse
No evidence shows hidden collection or remote control; audio is sent to Qooly only after a conversion choice [Q6][Q7][Q16].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, active-tab, tab-audio capture, offscreen-document, display, and all-site host access; the all-site grant is broader than the demonstrated feature needs.
Declares the permissions, <all_urls>, and a qooly.com-only content script. — manifest.json:14-33
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains screenshot handlers and debugger calls, while no other packaged script sends those screenshot message types. — background.js:1-13
Does not declare debugger and injects content code only on qooly.com. — manifest.json:14-33
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only content script is the Qooly conversion uploader, not a general page-data collector. — manifest.json:29-33
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores settings and a generated local identifier in Chrome storage and saves the most recent recording blob in extension IndexedDB.
Creates a local random user ID and persists extension state. — background.js:1-13
Writes the completed WEBM blob to the extension's myDatabase IndexedDB store. — recorder.js:1-13
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture microphone and tab audio and create local recording downloads, but does not capture camera video or arbitrary device files.
Obtains a tabCapture stream ID and starts the offscreen recorder. — background.js:1-13
Uses getUserMedia and MediaRecorder to combine microphone and tab audio. — recorder.js:1-13
Creates a local object URL and triggers a WEBM download. — recorded.js:1-13
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
A user-selected conversion sends the recorded audio file to qooly.com through its upload field; install and uninstall flows also open Qooly pages. No hidden telemetry upload was found.
Opens the Qooly converter and sends an INITIATE_CONVERSION message containing the local blob URL. — recorded.js:1-13
Converts the blob to a File and assigns it to the Qooly page's file input. — content-upload.js:1-2
Opens the Qooly welcome page on installation and configures a Qooly uninstall feedback URL. — background.js:1-13
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Recording logic and destinations are packaged as fixed local code. — background.js:1-13
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Recording continues automatically after the user starts it, but the start path is an explicit popup choice or configured keyboard command.
Presents recording-mode controls and sends the start request from user interaction. — popup.js:1-13
Keyboard commands select voice, tab, or combined recording for the active tab. — background.js:1-13
MediaRecorder continues until stopped or its source track ends. — recorder.js:1-13
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-setting override or related permission. — manifest.json:14-35
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is distributed as large minified Webpack/Vue bundles, but important services and data flows remain identifiable; minification is not evidence of abuse.
Minified production bundle retains named Chrome APIs and message types. — background.js:1-13
Minified bundle retains readable MediaRecorder and storage operations. — recorder.js:1-13
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only new Function match is a standard bundled global-object fallback guarded by a globalThis check. — settings.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no history or webNavigation permission and has no general content script. — manifest.json:14-33
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates and stores a UUID-like user ID locally; no network sink for it appears in the bundle. — background.js:1-13
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies permission or general page-input collector. — manifest.json:14-33
Does it record typing, form entries, clipboard contents, or screenshots?
It records microphone and tab audio after user initiation; no keystroke, clipboard, camera, or demonstrated screenshot capture occurs.
Requests microphone and tab media streams and records their audio tracks. — recorder.js:1-13
Dormant screenshot handlers have no packaged sender and the full-page debugger path lacks permission. — background.js:1-13
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles packaged extension messages, commands, and lifecycle events without a remote control socket. — background.js:1-13
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Assigns the recording File to Qooly's upload input and dispatches input/change events. — content-upload.js:1-2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no request-interception, proxy, or downloads permission. — manifest.json:14-21
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Uses Chrome tab capture and display information but declares no native or enterprise integration. — manifest.json:14-21
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Opens a fixed converter URL and transfers a local recording blob only after a conversion action. — recorded.js:1-13
Treats the transferred object strictly as a WEBM file. — content-upload.js:1-2
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares a Qooly content script but no externally_connectable entry. — manifest.json:29-55
Uses chrome.runtime.onMessage and no window.postMessage listener. — content-upload.js:1-2
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Starts capture from popup messages or explicit recording commands and routes stop commands. — background.js:1-13
Uses getUserMedia for microphone permission and stops media tracks when recording ends. — recorder.js:1-13
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is attributable to media recording, storage monitoring, and audio processing. — recorder.js:1-13
Does it change form fields or where a form sends its information?
It programmatically fills Qooly's upload input with the current recording after the user chooses remote conversion. The destination is fixed and feature-related; it does not rewrite form actions or collect other form fields.
Opens the fixed Qooly converter and sends the recording blob after the conversion action. — recorded.js:1-13
Creates a WEBM File, assigns it to the Qooly file input, and dispatches input/change events. — content-upload.js:1-2