Is Smart Audio Capture safe?

High risk

Smart Audio Capture transmits the URL of every page you visit, along with the previous URL, to its own compliance server.

On every completed page navigation across all tabs, the extension POSTs the current URL and the prior URL for that tab to smartaudiocapture.com/api/compliance, paired with a persistent analytics ID. This means the extension builds a sequenced record of your full browsing history on its servers. Separately, it reports session activity to Google Analytics every 60 minutes using a persistent UUID stored in extension storage.

Alissandr Davisv1.0.4Chrome Web Store
78Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every tab URL sent to smartaudiocapture.com on each page load

We captured POSTs to smartaudiocapture.com/api/compliance on every tab navigation, 10 in a two-minute session.

Each body has the URL just loaded, a timestamp, and a persistent linking ID.

Fires on every site, no prompt or UI disclosure.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open or navigate to any page in any browser tab.

The extension did this

The extension immediately POSTs your full page URL to smartaudiocapture.com/api/compliance.

The request includes the current URL, the previous URL for that tab, a Unix timestamp, and a persistent request ID tied to your Google Analytics client ID.

Captured request
POSThttps://smartaudiocapture.com/api/compliance

JSON response with a 'disabled' boolean that controls whether the extension's toolbar button is enabled for this tab.

Headers
Content-Type
application/json
Body
{  "url": "https://www.facebook.com/",  "main": "",  "_r": 1780617886830,  "reqId": "95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7"}
Fields sent in every compliance POST
  • Current page URL
    https://www.facebook.com/

    The full address of the page you just loaded, including any sensitive path or query parameters.

  • Previous page URL
    https://www.google.com/search?q=bank+account

    The last URL you visited in the same tab, letting the server reconstruct your tab's navigation path.

  • Timestamp
    1780617886830

    Unix millisecond timestamp of the navigation.

  • Request ID (reqId)
    95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7

    A persistent identifier shared across all compliance requests and GA4 analytics calls, linking your browsing data across requests.

The code that does this

Compliance listener, the event and the POST

Readable version
// Compliance class constructor — background.js module 19chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {  if (tabId && tab.id && tab.url && changeInfo.status === 'complete') {    this.checkUrl(tabId, tab.url).then(async (isAllowed) => {      const isEnabled = await chrome.action.isEnabled(tabId);      if (isEnabled && !isAllowed) chrome.action.disable(tabId);      else if (!isEnabled && isAllowed) chrome.action.enable(tabId);    }).catch(() => {});  }});async checkUrl(tabId, currentUrl) {  const endpoint = this.baseUrl + 'api/compliance';          // 'https://smartaudiocapture.com/api/compliance'  const previousUrl = this.urls[tabId] ?? '';                // previous URL for this tab  const payload = {    url: currentUrl,    main: previousUrl,    _r: +new Date(),                                         // Unix ms timestamp    reqId: this._reqId                                       // GA4 client UUID (shared)  };  this.urls[tabId] = currentUrl;                             // cache for next navigation  const response = await fetch(endpoint, {    method: 'POST',    body: JSON.stringify(payload)  });  if (!response.ok) return true;  const { disabled } = await response.json();  return !disabled;}
Destination receiving browsing data
    • smartaudiocapture.com

    Operated by the extension vendor (Smart Audio Capture). Receives every visited URL and previous URL via the /api/compliance endpoint.

GA4 analytics tracks extension usage with a persistent device ID

A POST to Google Analytics (GA4) fires the instant the extension loads, no navigation needed.

It assigns a persistent UUID on install, reused every call, plus a 60-minute ping.

The hardcoded ID and secret let the developer count devices.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension or Chrome restarts.

The extension did this

The extension immediately sends a 'run' event to Google Analytics with a persistent UUID identifying your browser.

The same UUID is sent every 60 minutes thereafter via a chrome.alarms recurring trigger, regardless of what you do.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-754GGNLDJK&api_secret=<redacted>

HTTP 204 No Content, GA4 accepted the event. Confirmed via dynamic analysis.

Headers
Content-Type
application/json
Body
{  "client_id": "a3f82b1c-9d47-4e2a-b6c1-d8e9f0a1b2c3",  "events": [    {      "name": "run",      "params": {        "session_id": "1780617800000",        "engagement_time_msec": 100      }    }  ]}
What's stored on your device

A UUID v4 made on first run and stored permanently, sent with every GA4 call so the dashboard can count distinct browsers.

Location
chrome.storage.local key 'cid'
Contents
a3f82b1c-9d47-4e2a-b6c1-d8e9f0a1b2c3
The code that does this

Persistent client ID creation and GA4 dispatch

Readable version
// Analytics class — background.js module 17const CLIENT_ID_KEY = 'cid';const GA4_ENDPOINT = 'https://www.google-analytics.com/mp/collect';const ALARM_INTERVAL_MINUTES = 60;const DEFAULT_ENGAGEMENT_MS = 100;async getOrCreateClientId() {  const stored = await chrome.storage.local.get(CLIENT_ID_KEY);  let clientId = stored[CLIENT_ID_KEY];  if (!clientId) {    clientId = uuid.v4();                                        // new UUID on first run    await chrome.storage.local.set({ [CLIENT_ID_KEY]: clientId }); // persisted permanently  }  return clientId;}async fireEvent(eventName, params = {}) {  if (!params.session_id) params.session_id = await this.getOrCreateSessionId();  if (!params.engagement_time_msec) params.engagement_time_msec = DEFAULT_ENGAGEMENT_MS;  await fetch(    `${GA4_ENDPOINT}?measurement_id=${this.measurement_id}&api_secret=${this.api_secret}`,    {      method: 'POST',      body: JSON.stringify({        client_id: await this.getOrCreateClientId(),        events: [{ name: eventName, params }]      })    }  );}// Startup call — background.js module 18, line 659analytics('G-754GGNLDJK', 'FCZDwChLTbG3IiCPDemxyw').then(clientId => {  this.compliance._reqId = clientId;   // same UUID also sent in compliance POSTs});// analytics() also creates a repeating alarm:chrome.alarms.create(measurementId, { periodInMinutes: 60 });chrome.alarms.onAlarm.addListener(() => analytics_instance.fireEvent('run'));
When this fires

Every 1 hour

A 'run' event is sent to GA4 every 60 minutes via chrome.alarms, independent of any user interaction with the extension.

Navigation path sent to compliance server via previous URL in each request

Captured POSTs to smartaudiocapture.com/api/compliance include not just the loaded page but the prior one, from a per-tab URL cache, in a 'main' field.

The shared persistent request ID lets the server rebuild each tab's browsing sequence.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You navigate from one page to another in any tab.

The extension did this

The extension sends both the new URL and the previous URL to smartaudiocapture.com, linking the two pages in every request.

All requests share the same persistent reqId, so the server can join them into a complete navigation sequence for each tab.

Captured request
POSThttps://smartaudiocapture.com/api/compliance

JSON with 'disabled' field determining whether the action button is enabled for the tab.

Headers
Content-Type
application/json
Body
{  "url": "https://www.google.com/",  "main": "https://www.facebook.com/checkpoint/blocked/",  "_r": 1780617891442,  "reqId": "95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7"}
The code that does this

Per-tab URL cache and navigation link construction

Readable version
// Compliance.checkUrl() — background.js module 19async checkUrl(tabId, currentUrl) {  const endpoint = this.baseUrl + 'api/compliance';  const previousUrl = this.urls[tabId] ?? '';          // previous URL cached for this tab  const payload = {    url: currentUrl,                                   // where you just navigated TO    main: previousUrl,                                 // where you came FROM    _r: +new Date(),    reqId: this._reqId                                 // persistent UUID (same as GA4 cid)  };  this.urls[tabId] = currentUrl;                       // cache for next navigation  const response = await fetch(endpoint, { method: 'POST', body: JSON.stringify(payload) });  if (!response.ok) return true;  const { disabled } = await response.json();  return !disabled;}
Navigation sequence reconstructed from captured compliance POSTs (dynamic analysis)
  1. t+0s

    You did

    Navigated to https://www.facebook.com/

    The extension did

    POST body: url=https://www.facebook.com/, main="" (first navigation, no prior URL)

  2. t+12s

    You did

    Navigated to https://www.facebook.com/checkpoint/blocked/

    The extension did

    POST body: url=facebook.com/checkpoint/..., main=https://www.facebook.com/

  3. t+28s

    You did

    Navigated to https://www.google.com/

    The extension did

    POST body: url=https://www.google.com/, main=https://www.facebook.com/checkpoint/blocked/

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Schedule its own background tasks

    alarms

  • Change per-site browser settings such as cookies, JavaScript and camera access

    contentSettings

  • Start, monitor and manage your downloads

    downloads

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Capture the video and audio of a tab

    tabCapture

Where it sends data

Destinations our analysis observed Smart Audio Capture contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Smart Audio Capture sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • smartaudiocapture.com

    Smart Audio Capture sends data to smartaudiocapture.com. One other extension we have analysed sends data here.

Updated 30 September 2026lfohcapleakcfmajfdeomgobhecliepj