Is Smart Audio Capture safe?
Smart Audio Capture transmits the URL of every page you visit, along with the previous URL, to its own compliance server.
On every completed page navigation across all tabs, the extension POSTs the current URL and the prior URL for that tab to smartaudiocapture.com/api/compliance, paired with a persistent analytics ID. This means the extension builds a sequenced record of your full browsing history on its servers. Separately, it reports session activity to Google Analytics every 60 minutes using a persistent UUID stored in extension storage.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every tab URL sent to smartaudiocapture.com on each page load
We captured POSTs to smartaudiocapture.com/api/compliance on every tab navigation, 10 in a two-minute session.
Each body has the URL just loaded, a timestamp, and a persistent linking ID.
Fires on every site, no prompt or UI disclosure.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open or navigate to any page in any browser tab.
The extension immediately POSTs your full page URL to smartaudiocapture.com/api/compliance.
The request includes the current URL, the previous URL for that tab, a Unix timestamp, and a persistent request ID tied to your Google Analytics client ID.
JSON response with a 'disabled' boolean that controls whether the extension's toolbar button is enabled for this tab.
- Content-Type
- application/json
{ "url": "https://www.facebook.com/", "main": "", "_r": 1780617886830, "reqId": "95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7"}- Current page URLhttps://www.facebook.com/
The full address of the page you just loaded, including any sensitive path or query parameters.
- Previous page URLhttps://www.google.com/search?q=bank+account
The last URL you visited in the same tab, letting the server reconstruct your tab's navigation path.
- Timestamp1780617886830
Unix millisecond timestamp of the navigation.
- Request ID (reqId)95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7
A persistent identifier shared across all compliance requests and GA4 analytics calls, linking your browsing data across requests.
Compliance listener, the event and the POST
// Compliance class constructor — background.js module 19chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { if (tabId && tab.id && tab.url && changeInfo.status === 'complete') { this.checkUrl(tabId, tab.url).then(async (isAllowed) => { const isEnabled = await chrome.action.isEnabled(tabId); if (isEnabled && !isAllowed) chrome.action.disable(tabId); else if (!isEnabled && isAllowed) chrome.action.enable(tabId); }).catch(() => {}); }});async checkUrl(tabId, currentUrl) { const endpoint = this.baseUrl + 'api/compliance'; // 'https://smartaudiocapture.com/api/compliance' const previousUrl = this.urls[tabId] ?? ''; // previous URL for this tab const payload = { url: currentUrl, main: previousUrl, _r: +new Date(), // Unix ms timestamp reqId: this._reqId // GA4 client UUID (shared) }; this.urls[tabId] = currentUrl; // cache for next navigation const response = await fetch(endpoint, { method: 'POST', body: JSON.stringify(payload) }); if (!response.ok) return true; const { disabled } = await response.json(); return !disabled;}- smartaudiocapture.com
Operated by the extension vendor (Smart Audio Capture). Receives every visited URL and previous URL via the /api/compliance endpoint.
GA4 analytics tracks extension usage with a persistent device ID
A POST to Google Analytics (GA4) fires the instant the extension loads, no navigation needed.
It assigns a persistent UUID on install, reused every call, plus a 60-minute ping.
The hardcoded ID and secret let the developer count devices.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the extension or Chrome restarts.
The extension immediately sends a 'run' event to Google Analytics with a persistent UUID identifying your browser.
The same UUID is sent every 60 minutes thereafter via a chrome.alarms recurring trigger, regardless of what you do.
HTTP 204 No Content, GA4 accepted the event. Confirmed via dynamic analysis.
- Content-Type
- application/json
{ "client_id": "a3f82b1c-9d47-4e2a-b6c1-d8e9f0a1b2c3", "events": [ { "name": "run", "params": { "session_id": "1780617800000", "engagement_time_msec": 100 } } ]}A UUID v4 made on first run and stored permanently, sent with every GA4 call so the dashboard can count distinct browsers.
- Location
- chrome.storage.local key 'cid'
a3f82b1c-9d47-4e2a-b6c1-d8e9f0a1b2c3Persistent client ID creation and GA4 dispatch
// Analytics class — background.js module 17const CLIENT_ID_KEY = 'cid';const GA4_ENDPOINT = 'https://www.google-analytics.com/mp/collect';const ALARM_INTERVAL_MINUTES = 60;const DEFAULT_ENGAGEMENT_MS = 100;async getOrCreateClientId() { const stored = await chrome.storage.local.get(CLIENT_ID_KEY); let clientId = stored[CLIENT_ID_KEY]; if (!clientId) { clientId = uuid.v4(); // new UUID on first run await chrome.storage.local.set({ [CLIENT_ID_KEY]: clientId }); // persisted permanently } return clientId;}async fireEvent(eventName, params = {}) { if (!params.session_id) params.session_id = await this.getOrCreateSessionId(); if (!params.engagement_time_msec) params.engagement_time_msec = DEFAULT_ENGAGEMENT_MS; await fetch( `${GA4_ENDPOINT}?measurement_id=${this.measurement_id}&api_secret=${this.api_secret}`, { method: 'POST', body: JSON.stringify({ client_id: await this.getOrCreateClientId(), events: [{ name: eventName, params }] }) } );}// Startup call — background.js module 18, line 659analytics('G-754GGNLDJK', 'FCZDwChLTbG3IiCPDemxyw').then(clientId => { this.compliance._reqId = clientId; // same UUID also sent in compliance POSTs});// analytics() also creates a repeating alarm:chrome.alarms.create(measurementId, { periodInMinutes: 60 });chrome.alarms.onAlarm.addListener(() => analytics_instance.fireEvent('run'));Every 1 hour
A 'run' event is sent to GA4 every 60 minutes via chrome.alarms, independent of any user interaction with the extension.
Navigation path sent to compliance server via previous URL in each request
Captured POSTs to smartaudiocapture.com/api/compliance include not just the loaded page but the prior one, from a per-tab URL cache, in a 'main' field.
The shared persistent request ID lets the server rebuild each tab's browsing sequence.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate from one page to another in any tab.
The extension sends both the new URL and the previous URL to smartaudiocapture.com, linking the two pages in every request.
All requests share the same persistent reqId, so the server can join them into a complete navigation sequence for each tab.
JSON with 'disabled' field determining whether the action button is enabled for the tab.
- Content-Type
- application/json
{ "url": "https://www.google.com/", "main": "https://www.facebook.com/checkpoint/blocked/", "_r": 1780617891442, "reqId": "95ef0f16-4a2b-4c3d-8f1e-a2b3c4d5e6f7"}Per-tab URL cache and navigation link construction
// Compliance.checkUrl() — background.js module 19async checkUrl(tabId, currentUrl) { const endpoint = this.baseUrl + 'api/compliance'; const previousUrl = this.urls[tabId] ?? ''; // previous URL cached for this tab const payload = { url: currentUrl, // where you just navigated TO main: previousUrl, // where you came FROM _r: +new Date(), reqId: this._reqId // persistent UUID (same as GA4 cid) }; this.urls[tabId] = currentUrl; // cache for next navigation const response = await fetch(endpoint, { method: 'POST', body: JSON.stringify(payload) }); if (!response.ok) return true; const { disabled } = await response.json(); return !disabled;}t+0s
You didNavigated to https://www.facebook.com/
The extension didPOST body: url=https://www.facebook.com/, main="" (first navigation, no prior URL)
t+12s
You didNavigated to https://www.facebook.com/checkpoint/blocked/
The extension didPOST body: url=facebook.com/checkpoint/..., main=https://www.facebook.com/
t+28s
You didNavigated to https://www.google.com/
The extension didPOST body: url=https://www.google.com/, main=https://www.facebook.com/checkpoint/blocked/
What it can do
Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Schedule its own background tasks
alarms
Change per-site browser settings such as cookies, JavaScript and camera access
contentSettings
Start, monitor and manage your downloads
downloads
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Capture the video and audio of a tab
tabCapture
Where it sends data
Destinations our analysis observed Smart Audio Capture contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Smart Audio Capture sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- smartaudiocapture.com
Smart Audio Capture sends data to smartaudiocapture.com. One other extension we have analysed sends data here.