Is Web Audio Recorder – Capture & Save MP3/WAV safe?

High risk

Web Audio Recorder is high risk. Web Audio Recorder sends page-navigation details to wanda.soundstreamcapture.com on every top-level page load: the page URL, referrer URL, HTTP status code, and a persistent UUID linking repeated events to the same browser profile.

Capture Appv2.4.9Chrome Web Store
72Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Page URLs Sent to Sound Stream Capture

Web Audio Recorder sends page-navigation details to wanda.soundstreamcapture.com on every top-level page load: the page URL, referrer URL, HTTP status code, and a persistent UUID linking repeated events to the same browser profile.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You load a top-level webpage.

This applies across sites because the content script is registered for all URLs and all frames.

The extension did this

The extension prepares a navigation event with the page URL, referrer, status, and a persistent browser ID.

The background service worker forwards that event through its Sentry client.

Navigation fields placed into the event context
  • Current page URL
    https://www.amazon.com/

    Shows the website and path you loaded. Full URLs can reveal searches, accounts, documents, or internal systems depending on the site.

  • Referrer URL
    https://www.amazon.com/

    Shows the page that led you to the current page when the browser exposes it.

  • Persistent browser ID
    302c95c3-b759-4667-ad21-ee1d16ff1a51

    Links repeated page visits to the same browser profile over time.

  • Page status
    200

    Adds context about whether the page loaded normally or hit an error.

  • Content type
    text/html

    Adds context about the type of page content being visited.

Captured request
POSThttps://wanda.soundstreamcapture.com/api/64/envelope/
The code that does this

The navigation event is assembled in the page and forwarded by the service worker

Readable version

Content script navigation event

javaScript/content.js
var df = (e => (e.GetAudioUrl = "GetAudioUrl", e.EncodingProgress = "EncodingProgress", e.SetAlarm = "SetAlarm", e.NavTrack = "NavTrack", e))(df || {});const pf = new URL(window.location.href).searchParams.get("isdowloadquery");window.self === window.top && !pf && ((() => {  const e = performance.getEntriesByType("navigation")[0],    n = (null == e ? void 0 : e.responseStatus) ?? 0,    t = document.contentType || "",    r = 0 === n || n >= 400 || !t;  chrome.runtime.sendMessage({    action: df.NavTrack,    data: {      referrerUrl: document.referrer || "",      targetUrl: window.location.href,      requestType: "main_frame",      contentType: t || null,      statusCode: n,      foreground: "visible" === document.visibilityState ? 1 : 0,      logType: r ? "handleReject" : "handleLoad"    }  })})()

Sentry setup, persistent UUID, and event forwarding

javaScript/background.js
const Sv = chrome.runtime.getManifest().version;nl({  dsn: "https://c95fccd778c34bf1915231e49f2dc6e4@wanda.soundstreamcapture.com/64",  release: Sv,  integrations: e => e.filter((e => "Breadcrumbs" !== e.name && "Dedupe" !== e.name)),  sampleRate: 1,  beforeBreadcrumb: () => null,  beforeSend: e => "handleReject" === (null == e ? void 0 : e.message) || "handleLoad" === (null == e ? void 0 : e.message) || Math.random() < .2 ? e : null});const bv = async () => {  var e, t;  const n = await (null == (t = null == (e = chrome.storage.local) ? void 0 : e.get) ? void 0 : t.call(e, "id"));  if (!n || !n.id) {    const e = crypto.randomUUID();    return await chrome.storage.local.set({      id: e    }), e  }  return n.id}, Ev = async e => {  const {    logType: t,    ...n  } = e;  Ks.setContext("req", {    fileDate: (new Date).toISOString(),    deviceTimestamp: Date.now(),    userId: await bv(),    ...n  }), Ks.captureMessage(t)};

Message listener dispatches NavTrack to the forwarding function

javaScript/background.js
Ks.setTag("context", "background-js"), Hd.createOffscreen(), chrome.runtime.onMessage.addListener((async ({  action: e,  data: t}) => {  switch (e) {    case Hn.GetAudioUrl:      await Wd(t);      break;    case Hn.EncodingProgress:      await Gd(t);      break;    case Hn.SetAlarm:      await gs(t);      break;    case Hn.NavTrack:      await Ev(t)  }  return !0}))
Remote service receiving the navigation events
    • wanda.soundstreamcapture.com

    Receives Sentry envelope POSTs containing navigation context from the extension.

Updated 30 September 2026pddjlpangidimliafldcpfkbkifmegbd