Is AudD® Music Recognition safe?

Medium risk

audd%C2%AE-music-recognition is medium risk. Starting music recognition sends api.audd.io the recorded audio plus tab/profile data: page URL/title, Google email/ID when available, a persistent device ID, version, and app ID. The live upload wasn't captured; fields come from source.

AudD, LLCv3.2.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Music Recognition Uploads Profile and Tab Details

Starting music recognition sends api.audd.io the recorded audio plus tab/profile data: page URL/title, Google email/ID when available, a persistent device ID, version, and app ID.

The live upload wasn't captured; fields come from source.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start music recognition from the extension popup.

The popup queries the active tab and asks the service worker to start recording when the popup logo is clicked.

The extension did this

The extension prepares an upload that combines the tab audio with profile and tab details.

The service worker passes tab URL, tab title, profile email, Google profile ID, and device ID into the popup before the popup posts the form.

02EvidenceFIELD TABLE
Multipart form fields added to the recognition request
FieldValueWhy it matters
Active page URL
https://music.youtube.com/watch?v=9bZkp7q19f0 (illustrative)Shows which page was open when you started recognition.
Active page title
Music video - YouTube (illustrative)Adds a readable page name to the recognition request.
Google profile email
alex.rivera@example.org (illustrative)Can connect the recognition request to your signed-in Chrome profile when Chrome provides it.
Google profile ID
109876543210987654321 (illustrative)Can connect multiple recognition requests to the same Chrome profile.
Persistent device ID
0.73482916558842461720567082391 (illustrative)Lets the extension link recognition activity from the same browser over time.
Recorded tab audio
multipart field named file containing a recorded audio Blob (illustrative)Contains the audio sample you asked the extension to identify.
Extension version and app ID
version=3.2.2; app_id=lhhohkfofnfbnildpdhhjeeenapeceeiIdentifies which extension build and Chrome extension ID submitted the request.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.audd.io/
Upload body not captured during dynamic analysis; source code constructs this POST when recording completes.
04EvidenceCODE COMPARE
The code that does this

The code path that collects profile and tab fields and posts them

What it actually does
Persistent device ID initializationbackground.js
chrome.storage.local.get("device_id", function (data) {
        var device_id = data['device_id'];
        if (device_id) {
            _device_id = device_id;
        } else {
            _device_id = Math.random() + "" + new Date().getTime();
            chrome.storage.local.set({
                "device_id": _device_id
            }, function () {
                console.log('storage set [device_id]');
            });
        }
    });
background_start collects tab and profile fieldsbackground.js
case "background_start":
			var tab = request.tab;
			if (request.tab == null) {
				console.error("no selected tab");
				chrome.runtime.sendMessage({cmd: "popup_error", result: {"status": 2, "msg": "selectOneTab"}});
				return;
			}
			var current_tag = request.tab;
			var tab_url = current_tag['url'];
			var tab_title = current_tag['title'];
			if (!current_tag['audible']) {
				chrome.runtime.sendMessage({cmd: "no_audio"});
				return;
			}

			chrome.identity.getProfileUserInfo(function(user_info) {
				var email = "";
				var google_id = "";
				if (chrome.runtime.lastError) {
					console.log(chrome.runtime.lastError.message);
					//chrome.runtime.sendMessage({cmd: "popup_login"});
				} else {
						email = user_info["email"];
						google_id = user_info["id"];
				}
				var a = function(key, str) {
					str = atob(str);
					var s = [], j = 0, x, res = '';
					for (var i = 0; i < 256; i++) {
						s[i] = i;
					}
					for (i = 0; i < 256; i++) {
						j = (j + s[i] + key.charCodeAt(i % key.length)) % 256;
						x = s[i];
						s[i] = s[j];
						s[j] = x;
					}
					i = 0;
					j = 0;
					for (var y = 0; y < str.length; y++) {
						i = (i + 1) % 256;
						j = (j + s[i]) % 256;
						x = s[i];
						s[i] = s[j];
						s[j] = x;
						res += String.fromCharCode(str.charCodeAt(y) ^ s[(s[i] + s[j]) % 256]);
					}
					return btoa(res);
				};
				var info = {
				"api_token": storageCache.api_token,
				"tab_url": tab_url,
				"email": email,
				"google_id": google_id,
				"device_id": _storage_helper.get_device_id(),
					"tab_title": tab_title};
				info[a("Wx!h", "+aIQwBctPPfCsTJZSmoLmSlij2WSLPLV")] = a('Cd8l', 'JT9+DxOFvXJivXR6VYiYUhpUHCAR08wA');
				on_paid_only = false;
				on_paid_only_without_trial = false;
				if(extensionConfig.paid_only) {
					for (website of extensionConfig.paid_only) {
						if(tab_url.includes(website)) {
							on_paid_only = true;
						}
					}
				}
				if(extensionConfig.paid_only_without_trial) {
					for (website of extensionConfig.paid_only_without_trial) {
						if(tab_url.includes(website)) {
							on_paid_only_without_trial = true;
						}
					}
				}
				if(on_paid_only_without_trial && !storageCache.api_token) {
					chrome.runtime.sendMessage({cmd: "popup_error", result: {"status": 2, "msg": "onlyPaidWorksHere"}});
					return;
				}
				if(on_paid_only && !storageCache.api_token) {
					chrome.identity.getAuthToken({
						'interactive': true
					}, function(token) {
						if(token == undefined) {
							//console.log(chrome.runtime.lastError.message);
							chrome.runtime.sendMessage({cmd: "popup_error", result: {"status": 2, "msg": "needAuth"}});
							return;
						}
					   var CWS_LICENSE_API_URL = 'https://www.googleapis.com/chromewebstore/v1.1/userlicenses/';
					    try {
						var req = new XMtpRequest();
						} catch(err) {
							chrome.runtime.sendMessage({cmd: "popup_error", result: {"status": 2, "msg": "trialEnded"}});
							return;
						}
						req.open('GET', CWS_LICENSE_API_URL + chrome.runtime.id);
						req.setRequestHeader('Authorization', 'Bearer ' + token);
						req.onreadystatechange = function() {
						  if (req.readyState == 4) {
							var license = JSON.parse(req.responseText);
							if(license.accessLevel == "FREE_TRIAL") {
								if((license.createdTime > 1521015562514) && (Date.now() - license.createdTime)/(1000*60*60*24) > 14) {
									chrome.runtime.sendMessage({cmd: "popup_error", result: {"status": 2, "msg": "trialEnded"}});
									return;
								}
							}
							//if(license.accessLevel == "FULL") {
								info["chrome_token"] = token;
								g_recognizer_client.start(info, storageCache.record_length);
							//}
						  }
						}
						req.send();
					});
				} else {
					g_recognizer_client.start(info, storageCache.record_length);
				}
			});

            break;
Popup posts every info key with the audio filesrc/popup/popup.js
function post_request(audio_buffer) {
	var server_url = "https://api.audd.io/";
	//var browser_version = navigator.userAgent;
	var post_data = new FormData();
	if(_info.api_token) {
		post_data.append('api_token', _info.api_token);
		// post_data.append('tab_url', "api:client");
	}
	
	for (var key in _info) {
		post_data.append(key, _info[key]);
	}
	var manifest = chrome.runtime.getManifest();
	var app_id = chrome.runtime.id;
	console.log(app_id);

	post_data.append('file', audio_buffer);
	//post_data.append('browser_version', browser_version);
	//post_data.append('market', chrome.i18n.getMessage("countryCode"));
	post_data.append('version', manifest.version);
	post_data.append("app_id", app_id);
	post_data.append('return', 'lyrics');
	
	$.ajax({
		type: 'POST',
		url: server_url,
		data: post_data,
		timeout : 15000,
		dataType: 'json',
		processData: false,
		contentType: false,
		success: function(data) {
			console.log(data);
			chrome.runtime.sendMessage({cmd: "success_post", result: data, info: _info});
		},
		error: function(error, textStatus) {
			console.log(error);
			var msg = "HTTP Error (Code = " + textStatus + ")";
			if (textStatus == 'timeout') {
				msg = "Network Timeout";
			}
			chrome.runtime.sendMessage({cmd: "popup_error_relay", result: {"status": 2, "text": msg}});
		}
	});
}
05EvidenceTHIRD PARTY LIST
External services involved in this recognition flow
  • api.audd.io

    AudD recognition API receiving the audio sample and metadata form fields.

  • www.googleapis.com

    Chrome Web Store license API used only on paid-only sites when the extension requests a Chrome auth token.

Updated 17 September 2026lhhohkfofnfbnildpdhhjeeenapeceei