Is Audio & Voice Recorder safe?

Medium risk

Records audio from browser tabs and lets you pause, stop, and download recordings as WAV files.

This extension captures sound from a selected Chrome tab for uses such as webinars, live broadcasts, music, or podcasts. It provides controls to start, pause, resume, and stop recording, then download the resulting audio file to your device. The store description says recordings and personal data are not retained by the extension.

Kirill Pugachevv3.1.0Chrome Web Store
47Risk
Who publishes it

Kirill Pugachev - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Kirill Pugachev
Website
keril.notion.site/Support-9dac655ff3444e5bb4afe39fad0c3e4c?pvs=74

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Behavioral telemetry sent to Google Analytics and PostHog on every interaction

Every popup open or click, including start/pause/stop/delete of a recording, sends the action, recording type, and duration to Google Analytics and PostHog.

A persistent random ID rides along, letting both build a history even signed out.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup or click any recording control.

This includes opening the popup, starting/pausing/stopping/resuming/deleting a recording, or using a keyboard shortcut.

The extension did this

The extension immediately POSTs the action name, recording type, and duration to Google Analytics and PostHog.

A stable UUID stored in your browser (chrome.storage.local key: clientId) is included in every request, linking all actions across sessions.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-B92NC209X2&api_secret=<redacted>

204 No Content (standard GA4 Measurement Protocol response)

Headers
Content-Type
application/json
Body
{  "client_id": "unauthorized_99d84ecb-9d5e-45e6-bda9-971dd8431d21",  "app_version": "3.1.0",  "events": [    {      "name": "popup_opened"    }  ]}
Fields sent in every telemetry request
  • Browser tracking ID
    unauthorized_99d84ecb-9d5e-45e6-bda9-971dd8431d21

    A random UUID generated once, stored permanently. Every request carries this ID, letting the developer link activity across sessions.

  • Event name
    button_clicked

    The specific action taken: opening the popup, starting or stopping a recording, a keyboard shortcut, or hitting the free-recording limit.

  • Recording duration
    00:02:37

    How long a recording session lasted, sent when you stop or delete a recording.

  • Recording type
    TAB

    Whether you recorded tab audio, microphone audio, or both, included in start, pause, stop, resume, and shortcut events.

  • Extension version
    3.1.0

    The installed version of the extension, sent with every event.

The code that does this

Dual-destination telemetry function (constants.js)

Readable version
const GA_URL = "https://www.google-analytics.com/mp/collect";const MEASUREMENT_ID = "G-B92NC209X2";const API_SECRET = "<redacted>";async function sendTelemetry(eventName, params) {  // Send to PostHog  posthog.capture(eventName, params);  // Send to Google Analytics (GA4 Measurement Protocol)  await fetch(`${GA_URL}?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SECRET}`, {    method: "POST",    body: JSON.stringify({      client_id: await getOrCreateClientId(),  // persistent UUID from chrome.storage.local      app_version: chrome.runtime.getManifest().version,      events: [{ name: eventName, params: params }]    })  });}
Destinations receiving behavioral telemetry
    • www.google-analytics.com

    Google Analytics GA4 Measurement Protocol endpoint. Receives every interaction event with the persistent client_id, under Google's analytics data policies.

    • us.i.posthog.com

    PostHog product analytics, US region. Same events sent via the bundled PostHog JS SDK. Project key phc_gngjyCI94gZ7pPdOhmctkwRwtP2Fi0i0F9g6PSbVa1y identifies the developer.

What it can do

Permissions this extension asks for, as declared in version 3.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on paywall.atst.tools

    https://paywall.atst.tools/*

  • Read and change your data on clerk.atst.tools

    https://clerk.atst.tools/*

  • Store data in your browser

    storage

  • Capture the video and audio of a tab

    tabCapture

  • Start, monitor and manage your downloads

    downloads

  • Read and change cookies, including the ones that keep you signed in

    cookies

Updated 30 September 2026deadjnaenmndpdpakgchpbedlcdmmoai