Is Music Identifier - Find any song from browser safe?

Medium risk

Music Identifier is medium risk. On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally. The automatic, unprompted fetch lets the operator change behavior remotely without a code update.…

Song Identifierv1.0.5Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote configuration fetched from operator domain on install

On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally.

The automatic, unprompted fetch lets the operator change behavior remotely without a code update.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the Music Identifier extension.

The extension did this

The service worker fetches a JSON configuration file from song-identify.com and stores it in your browser without a consent prompt.

Any errors during the fetch are discarded without logging. The stored settings object can contain arbitrary keys that affect extension behavior.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://song-identify.com/settings.json
Returns a JSON object stored as the 'settings' key in chrome.storage.local.
03EvidenceSTORAGE DUMP
What's stored on your device

The operator's server delivered this config on install. Fields like `isInstall`, `isOpen`, `count` can gate prompts or feature flags.

Locationchrome.storage.local key 'settings'
Contents (JSON)
{
  "count": 10,
  "isOpen": true,
  "status": "ok",
  "message": "",
  "isInstall": true,
  "request_id": 0
}
04EvidenceCODE COMPARE
The code that does this

Remote config fetch on install (bg.js:1-13)

What it actually does
chrome.runtime.onInstalled.addListener(async (event) => {
  if (event.reason === chrome.runtime.OnInstalledReason.INSTALL) {
    await (async function fetchRemoteConfig() {
      try {
        const response = await fetch('https://song-identify.com/settings.json');
        if (!response.ok) throw new Error('Network response was not ok');
        const config = await response.json();
        if (config.error) throw new Error(config.error);
        chrome.storage.local.set({ settings: config }); // store operator config
      } catch (e) { /* errors discarded, no logging */ }
    })();
  }
});
05EvidenceTHIRD PARTY LIST
Configuration endpoint
  • song-identify.com

    Extension operator's domain. Serves the settings.json configuration fetched on every fresh install. Distinct from shazam.com, which handles song recognition.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Persistent install ID sent with every song-recognition request and beacon

Music Identifier assigns each install a unique ID (`inid`) on first popup open, stores it a year, and sends it with every Shazam request and analytics beacon, linking your activity to one profile.

Undisclosed in the listing.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open the Music Identifier popup for the first time.

The extension did this

The extension generates a random UUID and saves it in your browser under `inidDetails` with a one-year expiry.

Every subsequent song lookup and UI interaction sends this same UUID to Shazam, letting them correlate your activity over the lifetime of the ID.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://www.shazam.com/services/webrec/match_extensionv2
Returns song match results. The inid field is not echoed back but is logged server-side.
Headers
Content-Typeapplication/json
Body
{
  "data": "<base64-audio-fingerprint>",
  "sessionId": "f3a1b2c4-9e7d-4f6a-8b0c-1d2e3f4a5b6c",
  "inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac",
  "lang": "en",
  "country": "US"
}
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://beacon.shazam.com/beacons/api/v1/beacon/shazam-extension/1.0.4/en/US/web/desktop/beacon/bd7b31a6-220a-4695-95d4-1c07534df9ac/screenview?screenname=home
Empty 200 OK; server-side event recorded with the inid in the URL path.
04EvidenceSTORAGE DUMP
What's stored on your device

Stored in local extension storage with an expiry timestamp. Persists across restarts and is reused a full year before a new ID is generated.

Locationchrome.storage.local key 'inidDetails'
Contents (JSON)
{
  "inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac",
  "inidExpiry": 1780000000
}
05EvidenceCODE COMPARE
The code that does this

UUID generation and storage (popup.js:16478-16495)

What it actually does
const stored = e.inidDetails;
const expiry = stored && stored.inidExpiry;
const nowSec = Math.round(Date.now() / 1000);
if (!stored || nowSec > expiry) {
  const uuid = `${randomHex(8)}-${randomHex(4)}-${randomHex(4)}-${randomHex(4)}-${randomHex(12)}`;
  const lifetimeSec = 31536000; // 1 year
  const newExpiry = Math.round(Date.now() / 1000) + lifetimeSec;
  chrome.storage.local.set({ inidDetails: { inid: uuid, inidExpiry: newExpiry } });
}
06EvidenceTHIRD PARTY LIST
Endpoints that receive the persistent inid
  • www.shazam.com

    Song recognition API. Every POST to /services/webrec/match_extensionv2 includes the inid field in the JSON body.

  • beacon.shazam.com

    Analytics and event tracking. The inid appears as a path segment in every beacon URL, covering popup pageviews and tagging lifecycle events.

Updated 17 September 2026enokdcnimpdlohalipcbkknffnhhdnac