Is Audio Master safe?
We analyzed Audio Master version 1.1.2's actual code and gave it a 86/100 trust score. Audio Master has purpose-appropriate permissions and no evidence of…
Bottom line
Audio Master has purpose-appropriate permissions and no evidence of abuse, but tab-audio capture is a meaningful privacy capability.
What it can access
It can inspect tab labels and capture audio from a chosen tab, while saving preferences through browser storage; this fits its audio-control purpose.[Q1][Q4][Q5][Q6]
Security weaknesses
No meaningful security weakness is shown: ordinary websites lack exposed privileged access, and the packaged code has no remote command or downloaded-code path.[Q7][Q16][Q21]
Signs of misuse
There is no evidence of tracking, collection of page or login data, traffic manipulation, or unexplained sharing beyond optional preference syncing.[Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, storage, offscreen processing and tabCapture. These permissions directly support its tab picker, saved presets and local audio-processing pipeline.
Declares tabs, storage, offscreen and tabCapture, with no host permission. — manifest.json:10-15
Uses tabCapture to obtain a chosen tab's audio stream and forwards the stream ID to the packaged offscreen processor. — background.js:179-229
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content_scripts, scripting permission or website host permission is declared. — manifest.json:1-65
The processing source is a tab media stream connected to local Web Audio nodes. — offscreen.js:62-173
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No content script, scripting permission or host permission exists. — manifest.json:1-65
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads active and audible-tab metadata, including title, URL and favicon, and stores settings. It does not access cookies, history, bookmarks or downloads.
Queries the active tab and audible tabs, then displays each audible tab's title, hostname and favicon. — popup.js:217-279
Cookies, history, bookmarks and downloads permissions are absent. — manifest.json:10-15
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It captures audio playing in a selected browser tab, but does not request microphone, camera, location, file, clipboard or installed-application access.
Requests a media stream ID for a specific tab through tabCapture. — background.js:208-213
getUserMedia is constrained to chromeMediaSource 'tab' with video disabled, then used as a local AudioContext source. — offscreen.js:69-98
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It may sync global preferences and custom preset names/settings through Chrome Sync. It sends no audio, tab metadata or page data to the developer or an analytics service.
Reads and writes globalSettings and customPresets with chrome.storage.sync, falling back to local storage. — popup.js:144-199
Developer support and Web Store pages open only after explicit clicks; there is no fetch, XHR, beacon or WebSocket. — popup.js:728-740
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Complete worker contains no external request or remotely controlled behavior. — background.js:1-395
Audio-processing nodes and message operations are fully packaged. — offscreen.js:1-366
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Command handling returns unless the user has enabled shortcuts, then applies only the declared audio commands. — background.js:350-394
Capture begins when a user enables or adjusts an audio control. — popup.js:529-703
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, search or proxy permission exists. — manifest.json:10-15
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable worker documents state, capture, storage and command flows. — background.js:1-395
Readable processor explicitly builds and tears down its Web Audio graph. — offscreen.js:1-366
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Timers receive declared arrow/function callbacks and no text is converted into code. — background.js:1-395
No dynamic-code primitive appears in the audio processor. — offscreen.js:1-366
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Tab metadata is rendered locally in the popup and is not persisted or transmitted. — popup.js:217-279
No history permission is requested. — manifest.json:10-15
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stored data consists of user preferences, equalizer presets, timestamps and session-specific tab state. — popup.js:144-199
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Captured audio is connected through local Web Audio nodes directly to the local audio destination. — offscreen.js:97-173
No application network transport or upload endpoint exists. — background.js:1-395
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Creates an in-memory audio graph without MediaRecorder, screenshot or file-writing code. — offscreen.js:62-173
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration or content script exists. — manifest.json:1-65
Runtime messages are routed among packaged popup, background and offscreen contexts. — background.js:232-280
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Click handlers open fixed support or Web Store URLs in new tabs. — popup.js:728-740
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission exists. — manifest.json:10-15
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
nativeMessaging and host permissions are absent; no localhost URL appears in the code. — manifest.json:1-65
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All executable behavior is direct packaged JavaScript. — background.js:1-395
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No web_accessible_resources, content_scripts or externally_connectable declaration is present. — manifest.json:1-65
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on user settings, audio state, tab lifecycle and declared keyboard commands. — background.js:1-395
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Builds a live ten-band EQ, mixer, gain, compressor, pan and limiter pipeline until capture stops. — offscreen.js:97-173, 181-255
Supports volume values through 800 and changes warning badge color above 100 and 400. — background.js:52-68, 314-348
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No scripting permission, content script or host permission is declared. — manifest.json:1-65