A video website that I occasionally use has gone mute. I received this prompt to give this website MIDI access:

MIDI Access

Is this safe to grant? Youtube and other websites do still play sound without any special permissions, but I'm not sure what the risks wold be if I allow this.

  • 1
    if you want to use midi gear on a MIDI-focused site, it's invaluable. otherwise, don't grant needless permissions; the same for MIDI as for anything. – dandavis Jun 20 '17 at 18:16

It is mostly safe, unless a new exploit has been found recently.

You're right to worry. There have been exploits using MIDI, like this one in Windows, and this one in Chrome, both of which were particularly nasty. They've both been patched for some time, but you never know when a new attack will be discovered.

Personally I wouldn't allow it unless I really wanted to hear the music-- and given that it's MIDI and not WAV or MP3, it is probably pretty horrible.

  • 1
    Just a note. Your answer touches on loading midi files. Chrome's MIDI API is a completely different thing. It is focused on less on playing midi files and more focused on the crafting/transport of SysEx messages. The permissions request is for this API. – Bacon Brad Jun 20 '17 at 22:10

It is important to know audio does not go through MIDI. MIDI is a transport for commands that can activate audio. A literal example is you have a musical keyboard that makes no sound. But it is plugged into a box that makes sound. So the keyboard passes commands to activate the sounds and can control of the notes, tone, octaves, etc. This transport can send (out), receive (in), or pass (thru) these commands. Take note these are specific commands and not really actual code.

What it cannot do is pass audio especially audio associated with a video. So unless this is a site in the realm of sending these commands to make sounds like an online synth or maybe even a music guide site I am unsure what is their intentions for using this.

It is also possible this is a poorly created site and was implemented on accident. Chrome will request access to MIDI devices regardless since the API is called.

While I know of no current exploits using this feature there are two previous CVEs I am aware of. CVE-2015-6792 and CVE-2015-6765 could both do a denial service attack, crash the browser, and possibly achieve arbitrary code execution outside of the sandbox. However both require older versions of Chrome such as 46 or 47.

So your intentional risks are you can have commands sent/read to connected MIDI interfaces. But the commands should be specific and not harmful in them self. But you are still allowing commands none the less.

The intentional risk could be an issue if you have your computer keyboard set up as a MIDI controller and the site reads these commands. As a result, it may act like a keylogger. However it won't send characters and will send commands like 1111111 or 7F and neither will correspond as the letter and number you pressed. But theoretically if the attacker knew how these were mapped out on your keyboard they can be crossed referenced and translated to what you typed. This is a highly unlikely scenario though.

Your unintentional risk is an exploit like the previously mentioned CVEs taking advantage to run any code. This is a risk you take with any use of a browser feature that accepts input from a site though.

Overall there is not enough information to go by to tell if this is a legit use of this API. You will have to use your best judgement if this functionality is required for your purpose of the site and how well you trust this site as well.

  • When a web page offers content with content-type of audio/midi, the content will be loaded by Windows Media Player, and typically will play back in accordance with the General MIDI standard established by Roland Corp, using virtual instruments implemented in software. Usually sounds really bad. – John Wu Jun 20 '17 at 20:43
  • @JohnWu Loading audio/midi content-types is not the same as Chrome's MIDI api. Here is an example of the MIDI api. – Bacon Brad Jun 20 '17 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.