Is Shazam: Find song names from your browser safe?
We analyzed Shazam: Find song names from your browser version 2.7.0's actual code and gave it a 76/100 trust score. This is a mostly purpose-aligned…
Bottom line
This is a mostly purpose-aligned Shazam extension with moderate privacy concerns from audio capture and persistent activity tracking.
What it can access
It can capture active-tab audio and store recognition data, which fits song identification, while page access is limited to Shazam sites.[Q1][Q5][Q4]
Security weaknesses
The Shazam-only storage bridge accepts loosely checked data, creating limited website misuse risk, but no broader privileged control was found.[Q21][Q9]
Signs of misuse
The extension sends recognition details and persistent-ID analytics to Shazam; this is feature-related but enables ongoing tracking without a visible opt-out.[Q6][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabCapture, storage, and unlimitedStorage. Its only persistent webpage access is limited to www.shazam.com and amp.shazam.com.
Declares tabCapture, storage, unlimitedStorage, and a content script restricted to two Shazam hosts. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
On Shazam pages only, it relays a fixed Apple Music connection storage value between the page and extension storage. It does not inspect general page content.
Handles only storage messages and CustomEvents whose key is amconnect. — contentScript.bundle.js:1
Limits this content script to Shazam domains. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only page interaction is the fixed amconnect storage bridge. — contentScript.bundle.js:1
Provides no arbitrary-site content-script access. — manifest.json:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores recognized-song history, new-match markers, locale, country, rating state, and a long-lived random installation identifier locally. One Apple Music connection value can use Chrome sync storage.
Creates inidDetails, shazam_matches, new_matches, locale, country, rating, and match-count records in local storage. — popup.bundle.js:39
Reads, writes, or removes the amconnect sync value for Shazam pages. — contentScript.bundle.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It captures audio playing in the active browser tab for song recognition. It has no microphone, camera, clipboard, download, or screen-capture permission.
Declares tabCapture but no microphone, camera, clipboard, downloads, or desktopCapture permission. — manifest.json:1
Calls chrome.tabCapture.capture with audio enabled and processes the returned audio stream. — popup.bundle.js:39
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends a locally generated audio signature, session ID, persistent installation ID, language, and country to Shazam's recognition service. Raw audio is processed locally and was not present in the traced request.
Passes captured Float32 audio through the packaged signature extractor and returns a signature byte array. — 11.bundle.js:1
Base64-encodes the signature and posts it with sessionId, inid, language, and country to Shazam match_extensionv2. — popup.bundle.js:39
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads Shazam country information and a fixed feature-flag JSON file. No downloaded value reaches an executable-code sink.
Fetches fixed Shazam country and website feature-configuration endpoints. — popup.bundle.js:39
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Audio capture starts automatically when the user opens the popup and stops after a match, cancellation, silence, or four timed attempts. Opening the popup is the required user action.
The initial popup state invokes startRecording and schedules attempts at 3, 6, 9, and 12 seconds with explicit cleanup. — popup.bundle.js:39
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings, proxy, declarativeNetRequest, search, or theme permission. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup is heavily minified and includes packaged WebAssembly, which reduces readability. The network services and feature logic remain visible, and no encrypted or self-modifying data was found.
Contains a production-minified React application and a readable recognition flow. — popup.bundle.js:1-44
Contains an Emscripten runtime for the packaged signature extractor. — 8f9fb4225afac2882f56.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses importScripts only for sigxJSPath supplied by the packaged popup worker setup. — 11.bundle.js:1
Constructs the worker and signature-script URLs from packaged extension resources. — popup.bundle.js:39
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no tabs or history permission and limits content scripts to Shazam pages. — manifest.json:1
The recognition request contains a signature and identifiers, not a tab URL. — popup.bundle.js:39
Does it create a persistent ID or browser fingerprint to recognize you?
It sends Shazam analytics tied to a long-lived random ID. Events can include screens, clicks, outcomes, recognized track IDs, locale, country, extension version, and browser details; no user-facing opt-out was found.
Creates a persistent inid and emits tagging, navigation, track, and playback events. — popup.bundle.js:39
Builds Shazam beacon URLs containing the ID and attaches locale, country, browser, version, screen, event, and track fields. — popup.bundle.js:44
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies permission or arbitrary-site page access. — manifest.json:1
The recognition body contains signature, session ID, installation ID, language, and country only. — popup.bundle.js:39
Does it record typing, form entries, clipboard contents, or screenshots?
It records active-tab audio in short intervals for recognition. It does not log keystrokes, read form values, take screenshots, or use the microphone or camera.
Captures tab audio, accumulates channel samples, and stops after bounded attempts. — popup.bundle.js:39
Declares tabCapture without microphone, camera, or screen-capture permission. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Stores match-response metadata and opens its webUrl or streaming links only from click handlers. — popup.bundle.js:39
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Restricts the content script to Shazam domains. — manifest.json:1
Does not alter page links, forms, or visible content. — contentScript.bundle.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, downloads, webRequest, or declarativeNetRequest permission. — manifest.json:1
Uses fixed Shazam recognition, count, feature, country, and beacon endpoints. — popup.bundle.js:39,44
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-system permission. — manifest.json:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches fixed feature and match endpoints and consumes their JSON as flags and song data. — popup.bundle.js:39
The worker imports only the internally supplied packaged signature runtime path. — 11.bundle.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Shazam pages can use a named CustomEvent to update Chrome sync storage. The bridge is restricted to Shazam hosts and requires the fixed amconnect key, though its data object is not further schema-validated.
Accepts contentscript_host:storageChange when key is amconnect and passes its data object to chrome.storage.sync.set. — contentScript.bundle.js:1
Loads this bridge only on www.shazam.com and amp.shazam.com. — manifest.json:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Auto-starts only within the opened popup and exposes retry and cancel controls with stream cleanup. — popup.bundle.js:39
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Calls the packaged extract_signature function on captured audio. — 11.bundle.js:1
Invokes signature extraction only during a recognition attempt. — popup.bundle.js:39
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The Shazam-only bridge performs storage synchronization and contains no form handling. — contentScript.bundle.js:1