Is Udio AI Music Generator safe?

Medium risk

Udio AI Music Generator reads your Chrome profile ID and sends it to livepolls.app for extension login.

When the extension UI opens, it requests the signed-in Chrome profile information and sends the profile ID to livepolls.app. The service returns a login passport that the extension stores locally and uses with a UUID to check account status.

v2.6Chrome Web Store
45Risk
Who publishes it

5 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

5 other listings published from this account, 16k+ users between them. 1 of them carries a finding.

Suno AI Music Generator8k+HighMicrosoft Word Translator - Translate Word online4k+MediumYouTube Video Dubbing2k+CleanEPUB Translator - Translate Ebook Online1k+CleanAI Avatar Generator686Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Chrome profile identifier exchanged with livepolls.app on UI load

Opening Udio AI Music Generator's UI sends your Chrome profile ID to livepolls.app/suno_ai_music_generator/api/user/passport.

The response's login passport, stored in browser storage, is then used in a status request with a ticket and uuid.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the extension UI.

The extension did this

The extension reads the signed-in Chrome profile identifier, sends it to livepolls.app, stores the returned login passport, and sends a follow-up status request.

Captured request
POSTwww.livepolls.app/suno_ai_music_generator/api/user/passport
Fields in the request and stored response
  • Browser storage data
    login_passport=lp_abc123 (illustrative)

    The returned login passport is persisted in localStorage and chrome.storage.sync, keeping the account linkage available after the UI load.

  • Access credential
    X-Access-Ticket=ticket_abc123 (illustrative)

    The follow-up status request uses an access ticket and uuid tied to the login flow.

What it can do

Permissions this extension asks for, as declared in version 2.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed Udio AI Music Generator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.livepolls.app

    Udio AI Music Generator sends data to www.livepolls.app. 15 other extensions we have analysed send data here.

Updated 30 September 2026mfgmpijgkphkefibdbjgbbopomghojhg