Is Music Identifier - Find any song from browser safe?
Music Identifier is medium risk. On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally. The automatic, unprompted fetch lets the operator change behavior remotely without a code update.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote configuration fetched from operator domain on install
On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally.
The automatic, unprompted fetch lets the operator change behavior remotely without a code update.
What actually happens
You install the Music Identifier extension.
The service worker fetches a JSON configuration file from song-identify.com and stores it in your browser without a consent prompt.
Any errors during the fetch are discarded without logging. The stored settings object can contain arbitrary keys that affect extension behavior.
Captured request
Returns a JSON object stored as the 'settings' key in chrome.storage.local.
What's stored on your device
The operator's server delivered this config on install. Fields like isInstall, isOpen, count can gate prompts or feature flags.
- Location
- chrome.storage.local key 'settings'
{ "count": 10, "isOpen": true, "status": "ok", "message": "", "isInstall": true, "request_id": 0}The code that does this
Remote config fetch on install (bg.js:1-13)
chrome.runtime.onInstalled.addListener(async (event) => { if (event.reason === chrome.runtime.OnInstalledReason.INSTALL) { await (async function fetchRemoteConfig() { try { const response = await fetch('https://song-identify.com/settings.json'); if (!response.ok) throw new Error('Network response was not ok'); const config = await response.json(); if (config.error) throw new Error(config.error); chrome.storage.local.set({ settings: config }); // store operator config } catch (e) { /* errors discarded, no logging */ } })(); }});Configuration endpoint
- song-identify.com
Extension operator's domain. Serves the settings.json configuration fetched on every fresh install. Distinct from shazam.com, which handles song recognition.
Persistent install ID sent with every song-recognition request and beacon
Music Identifier assigns each install a unique ID (inid) on first popup open, stores it a year, and sends it with every Shazam request and analytics beacon, linking your activity to one profile.
Undisclosed in the listing.
What actually happens
You open the Music Identifier popup for the first time.
The extension generates a random UUID and saves it in your browser under inidDetails with a one-year expiry.
Every subsequent song lookup and UI interaction sends this same UUID to Shazam, letting them correlate your activity over the lifetime of the ID.
Captured request
Returns song match results. The inid field is not echoed back but is logged server-side.
- Content-Type
- application/json
{ "data": "<base64-audio-fingerprint>", "sessionId": "f3a1b2c4-9e7d-4f6a-8b0c-1d2e3f4a5b6c", "inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac", "lang": "en", "country": "US"}Captured request
Empty 200 OK; server-side event recorded with the inid in the URL path.
What's stored on your device
Stored in local extension storage with an expiry timestamp. Persists across restarts and is reused a full year before a new ID is generated.
- Location
- chrome.storage.local key 'inidDetails'
{ "inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac", "inidExpiry": 1780000000}The code that does this
UUID generation and storage (popup.js:16478-16495)
const stored = e.inidDetails;const expiry = stored && stored.inidExpiry;const nowSec = Math.round(Date.now() / 1000);if (!stored || nowSec > expiry) { const uuid = `${randomHex(8)}-${randomHex(4)}-${randomHex(4)}-${randomHex(4)}-${randomHex(12)}`; const lifetimeSec = 31536000; // 1 year const newExpiry = Math.round(Date.now() / 1000) + lifetimeSec; chrome.storage.local.set({ inidDetails: { inid: uuid, inidExpiry: newExpiry } });}Endpoints that receive the persistent inid
- www.shazam.com
Song recognition API. Every POST to /services/webrec/match_extensionv2 includes the inid field in the JSON body.
- beacon.shazam.com
Analytics and event tracking. The inid appears as a path segment in every beacon URL, covering popup pageviews and tagging lifecycle events.
What it can do
Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.0.7, which we have not unpacked yet.
Read and change your data on every site you visit
*://*/*
See the address and title of every tab you have open
tabs
Capture the video and audio of a tab
tabCapture
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Run its own code inside the pages you visit
scripting