Is Web Audio Recorder – Capture & Save MP3/WAV safe?
We analyzed Web Audio Recorder – Capture & Save MP3/WAV version 2.4.9's actual code and gave it a 35/100 trust score. The recording feature is plausible,…
Bottom line
The recording feature is plausible, but automatic collection of full browsing history and a persistent identifier makes this extension high risk.
What it can access
It runs on every website, captures active-tab audio, and can save files; recording fits its purpose, but broad page access and automatic URL collection exceed it.[Q1][Q6][Q12]
Security weaknesses
Automatic page-wide collection can expose sensitive information in URLs and referrers, including private links or searches.[Q8][Q14]
Signs of misuse
The extension sends every visited URL and referrer to its service and links them across sessions with a persistent ID, unrelated to recording.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access on every page and can capture active-tab audio, store settings, create an offscreen recorder, and initiate downloads.
Requests storage, activeTab, offscreen, tabCapture, downloads and alarms and injects content.js into <all_urls> in every frame. — manifest.json:13-35
Uses a tab media-stream ID with getUserMedia and a packaged WebAudioRecorder to capture active-tab audio. — javaScript/recorder.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It appends an empty extension-specific div to every top-level page. No visible content, links, inputs, or styling are changed.
On window load it creates a div with an ID derived from the extension ID, appends it to body, and mounts a React component that renders nothing. — javaScript/content.js:37
The content script is registered on all URLs and all frames, with a top-frame guard around its first-party behavior. — manifest.json:21-31
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
First-party code reads location, referrer, content type, navigation status and visibility; it has no form-field query or input-event listener. — javaScript/content.js:37
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It records the current page and referring page for every top-level navigation. It does not read cookies or authenticated session storage directly.
Builds NavTrack data with targetUrl: window.location.href and referrerUrl: document.referrer on each top-level page. — javaScript/content.js:37
Adds a persistent extension ID and timestamps before sending the navigation event through Sentry. — javaScript/background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can record sound playing in the active tab and save MP3 or WAV files. It has no camera, geolocation, native-messaging, or arbitrary local-filesystem access.
Requests tabCapture, activeTab, offscreen and downloads for the recording workflow. — manifest.json:13-19
Obtains the selected tab stream, records two-channel audio, creates a local Blob URL, and returns it for download. — javaScript/recorder.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends full visited-page URLs, referrers, navigation details, timestamps, extension version, and a persistent ID to wanda.soundstreamcapture.com. Recorded audio is not uploaded.
Sends targetUrl, referrerUrl, response status, content type and foreground state to the background worker as NavTrack. — javaScript/content.js:37
Initializes Sentry at wanda.soundstreamcapture.com, adds a persistent UUID and timestamps to the req context, and captures handleLoad/handleReject messages. — javaScript/background.js:1
The completed audio remains a local Blob URL delivered to the extension for chrome.downloads; no network sender receives the Blob. — javaScript/recorder.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Extension-page CSP limits scripts to the package. — manifest.json:44-45
Network-facing first-party logic initializes Sentry and opens soundstreamcapture.com on install; no response controls extension behavior. — javaScript/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Browsing telemetry runs automatically on every top-level page load, without requiring the user to open the recorder or start recording.
Chrome injects the content script automatically at document_end on all URLs. — manifest.json:21-31
Immediately sends NavTrack when running in the top frame unless the isdowloadquery parameter is present. — javaScript/content.js:37
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings, search, override, proxy, privacy, management, or declarativeNetRequest capability. — manifest.json:1-65
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The production scripts are heavily minified and combine first-party logic with React, Sentry, and audio libraries, making review harder, though meaningful names and sinks remain traceable.
Lists large single-line background, popup, content, React/Sentry and MP3 encoder bundles. — inventory.json:1
A roughly 319 KB one-line minified bundle contains both Sentry and first-party event code. — javaScript/background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
getCFunc can eval an underscored symbol name if Module lacks it, and cwrap can eval a locally generated wrapper string. — recorder/WebAudioRecorderMp3.min.js:1
The live Encoder constructor aliases Module._lame_* functions directly and invokes those aliases; no ccall/cwrap use or remote input was found. — recorder/WebAudioRecorderMp3.min.js:1
The MV3 extension CSP permits wasm-unsafe-eval but not general unsafe-eval, further limiting string evaluation on extension pages. — manifest.json:44-45
Does it track the websites, pages, searches, or links you visit?
It tracks browsing activity by reporting every top-level destination URL and referrer, rather than merely recording activity inside its own popup.
On ordinary pages it sends window.location.href and document.referrer as a main_frame navigation event. — javaScript/content.js:37
All handleLoad and handleReject events pass beforeSend, while unrelated Sentry events are sampled at 20%. — javaScript/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
Browsing telemetry is linked across sessions with a persistent random UUID and includes precise client timestamps and extension version.
Loads id from chrome.storage.local or creates and stores crypto.randomUUID(), then adds it as userId with fileDate and deviceTimestamp. — javaScript/background.js:1
Configures the current manifest version as the Sentry release. — javaScript/background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Full URLs and referrers leave the browser and may expose searches, private paths, document identifiers, invitation links, or secrets placed in query strings.
Uses the complete window.location.href and document.referrer without redaction or origin-only reduction. — javaScript/content.js:37
Places those values in Sentry context sent to the publisher-controlled endpoint. — javaScript/background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It intentionally captures active-tab audio after a user starts recording. It does not monitor typing, clipboard contents, screenshots, camera, or ambient microphone input.
Requests audio from chromeMediaSource tab using a media-stream ID supplied by tabCapture and records until stopped or timed out. — javaScript/recorder.js:1
Requests tabCapture but no clipboard, desktopCapture, camera, or broad microphone permission. — manifest.json:13-19
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable origins or web-accessible command bridge. — manifest.json:1-65
Runtime listeners handle fixed internal recording, alarm, audio-URL, and navigation-telemetry actions. — javaScript/background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
First-party page code sends navigation metadata and appends an empty div; no links, ads, search results, or referral values are changed. — javaScript/content.js:37
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or debugger permission. — manifest.json:13-35
Reads the completed Navigation Timing entry and current page metadata after load; it does not control the request. — javaScript/content.js:37
Can it communicate with software on the computer or services running on localhost?
Because the all-sites page access also runs on reachable localhost and private-network web pages, their URLs and referrers can be reported, though the extension does not read their page bodies or use native messaging.
The <all_urls> match includes ordinary HTTP/HTTPS pages on local and private-network hosts. — manifest.json:21-31
The same full-URL NavTrack logic applies without a public-host restriction. — javaScript/content.js:37
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads Mp3LameEncoder.min.js.mem from the packaged worker directory and exposes local LAME functions. — recorder/WebAudioRecorderMp3.min.js:1
Configures WebAudioRecorder with workerDir /recorder/ and fixed mp3 or wav encoding. — javaScript/recorder.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable origins or web_accessible_resources. — manifest.json:1-65
First-party code sends one-way runtime telemetry and mounts an empty component; no page-message listener is registered. — javaScript/content.js:37
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The only first-party page condition is top-frame execution and absence of the isdowloadquery query parameter. — javaScript/content.js:37
beforeSend always retains handleLoad/handleReject messages and randomly retains 20% of other Sentry events. — javaScript/background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Encoding processes captured audio locally with a configured one-to-twenty-minute time limit and reports progress. — javaScript/recorder.js:1
The worker's computation is LAME audio encoding and stops when recording completes or is cancelled. — recorder/WebAudioRecorderMp3.min.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
First-party code does not query form/input elements, attach input or submit handlers, or change action/formAction attributes. — javaScript/content.js:37
React's bundled generic DOM support contains form-related framework code, but the mounted first-party component returns no UI and supplies no form props. — javaScript/content.js:37