Is speech to text for chatgp safe?
speech to text for chatgp is high risk. DA captured Speech to Text sending browsing history to its own server on every page, not just AI sites: URL, title, referrer, plus a device ID, to service.voicewave.xyz/get_styles_for_web_tts. Seen on Google, Amazon, ChatGPT navigations.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Full browsing history sent to voicewave.xyz on every page visit
DA captured Speech to Text sending browsing history to its own server on every page, not just AI sites: URL, title, referrer, plus a device ID, to service.voicewave.xyz/get_styles_for_web_tts.
Seen on Google, Amazon, ChatGPT navigations.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any page in Chrome.
This applies to all HTTP and HTTPS URLs, not only AI chat or speech-related sites.
The extension immediately posts your URL, page title, referrer, and a persistent device ID to service.voicewave.xyz.
The request fires before the page is fully loaded, on every navigation including SPA route changes and back/forward history events.
Dynamic analysis captured 3 POST requests of this form during navigation to Google, Amazon, and ChatGPT in sequence.
- Content-Type
- application/json
[ { "m": "vw-ch", "uid": "ext_1776242110867_avpte62lg", "ev": "6.0.1", "ct": "text/html", "nm": "pageview", "nt": "foreground", "u": "https://www.google.com/", "r": "", "title": "Google" }]- Page URLhttps://www.amazon.com/s?k=diabetes+medication
The full address of every page you visit, including any search queries or private URL parameters.
- Referring pagehttps://www.google.com/search?q=diabetes+medication
The URL of the page you came from, revealing navigation patterns between sites.
- Page titleAmazon.com: diabetes medication
The visible title of the page, which often contains more detail than the URL alone.
- Persistent client IDext_1776242110867_avpte62lg
A unique ID generated once, stored permanently. It ties every request, across all sites and sessions, to your browser install.
- Extension version6.0.1
The installed version of the Speech to Text extension.
This ID is generated once and never rotated, linking every page visit across any site into one browsing profile tied to your browser.
- Location
- chrome.storage.local key 'voicewaveClientId'
{ "voicewaveClientId": "ext_1776242110867_avpte62lg"}- service.voicewave.xyz
Receives browsing history (URL, title, referrer, client ID) each navigation. Operated by Voicewave. Path suggests TTS styling, but the body holds only navigation telemetry.
Uses mitmproxy to intercept and display the POST requests Speech to Text sends to voicewave.xyz while you browse. Run this before installing the extension to establish a baseline, then install and navigate to any website to see the requests appear.
- Python 3.8+
- mitmproxy (pip install mitmproxy)
- Chrome configured to use HTTP proxy 127.0.0.1:8080
#!/usr/bin/env bash# Requires: mitmproxy (pip install mitmproxy)# Usage: run this script, then configure Chrome to use 127.0.0.1:8080 as HTTP proxymitmdump -q --mode regular \ --showhost \ -s /dev/stdin <<'HOOK'from mitmproxy import httpimport jsondef request(flow: http.HTTPFlow) -> None: if "voicewave.xyz" in flow.request.host: print(f"\n[VOICEWAVE REQUEST]") print(f" URL : {flow.request.pretty_url}") try: body = json.loads(flow.request.content) for item in body: print(f" uid : {item.get('uid','?')}") print(f" page: {item.get('u','?')}") print(f" ref : {item.get('r','?')}") print(f" ttl : {item.get('title','?')}") except Exception: print(f" raw : {flow.request.content[:500]}")HOOK- 1Install mitmproxy: pip install mitmproxy
- 2Run: bash check_voicewave_traffic.sh
- 3Set Chrome's HTTP proxy to 127.0.0.1:8080
- 4Visit any site with the extension on
- 5Each visit prints the URL, referrer, client ID sent to voicewave.xyz