Is speech to text for chatgp safe?
speech to text for chatgp is high risk. DA captured Speech to Text sending browsing history to its own server on every page, not just AI sites: URL, title, referrer, plus a device ID, to service.voicewave.xyz/get_styles_for_web_tts. Seen on Google, Amazon, ChatGPT navigations.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Full browsing history sent to voicewave.xyz on every page visit
DA captured Speech to Text sending browsing history to its own server on every page, not just AI sites: URL, title, referrer, plus a device ID, to service.voicewave.xyz/get_styles_for_web_tts.
Seen on Google, Amazon, ChatGPT navigations.
You navigate to any page in Chrome.
This applies to all HTTP and HTTPS URLs, not only AI chat or speech-related sites.
The extension immediately posts your URL, page title, referrer, and a persistent device ID to service.voicewave.xyz.
The request fires before the page is fully loaded, on every navigation including SPA route changes and back/forward history events.
| Content-Type | application/json |
[
{
"m": "vw-ch",
"uid": "ext_1776242110867_avpte62lg",
"ev": "6.0.1",
"ct": "text/html",
"nm": "pageview",
"nt": "foreground",
"u": "https://www.google.com/",
"r": "",
"title": "Google"
}
]| Field | Value | Why it matters | |
|---|---|---|---|
Page URL | https://www.amazon.com/s?k=diabetes+medication | The full address of every page you visit, including any search queries or private URL parameters. | |
Referring page | https://www.google.com/search?q=diabetes+medication | The URL of the page you came from, revealing navigation patterns between sites. | |
Page title | Amazon.com: diabetes medication | The visible title of the page, which often contains more detail than the URL alone. | |
Persistent client ID | ext_1776242110867_avpte62lg | A unique ID generated once, stored permanently. It ties every request, across all sites and sessions, to your browser install. | |
Extension version | 6.0.1 | The installed version of the Speech to Text extension. |
This ID is generated once and never rotated, linking every page visit across any site into one browsing profile tied to your browser.
chrome.storage.local key 'voicewaveClientId'{
"voicewaveClientId": "ext_1776242110867_avpte62lg"
}- service.voicewave.xyz
Receives browsing history (URL, title, referrer, client ID) each navigation. Operated by Voicewave. Path suggests TTS styling, but the body holds only navigation telemetry.
Uses mitmproxy to intercept and display the POST requests Speech to Text sends to voicewave.xyz while you browse. Run this before installing the extension to establish a baseline, then install and navigate to any website to see the requests appear.
#!/usr/bin/env bash
# Requires: mitmproxy (pip install mitmproxy)
# Usage: run this script, then configure Chrome to use 127.0.0.1:8080 as HTTP proxy
mitmdump -q --mode regular \
--showhost \
-s /dev/stdin <<'HOOK'
from mitmproxy import http
import json
def request(flow: http.HTTPFlow) -> None:
if "voicewave.xyz" in flow.request.host:
print(f"\n[VOICEWAVE REQUEST]")
print(f" URL : {flow.request.pretty_url}")
try:
body = json.loads(flow.request.content)
for item in body:
print(f" uid : {item.get('uid','?')}")
print(f" page: {item.get('u','?')}")
print(f" ref : {item.get('r','?')}")
print(f" ttl : {item.get('title','?')}")
except Exception:
print(f" raw : {flow.request.content[:500]}")
HOOK- 1Install mitmproxy: pip install mitmproxy
- 2Run: bash check_voicewave_traffic.sh
- 3Set Chrome's HTTP proxy to 127.0.0.1:8080
- 4Visit any site with the extension on
- 5Each visit prints the URL, referrer, client ID sent to voicewave.xyz