How to Block MIDI Devices Access Globally in Google Chrome

The Audio Hardware Bridge Vector

Google Chrome features a powerful, low-level hardware interface known as the Web MIDI API. By default, the browser allows specialised websites to request direct, raw communication with MIDI (Musical Instrument Digital Interface) devices connected to your computer (such as electronic keyboards, drum machines, synthesisers, and audio mixing hardware). While an incredible technical achievement that enables web-based digital audio workstations (DAWs), it is a security vulnerability. Malicious websites can exploit this API to scan for connected MIDI hardware, fingerprinting your specific studio setup, or potentially inject malicious MIDI System Exclusive (SysEx) messages into connected equipment. You must permanently paralyse the browser’s ability to bridge the web to your local MIDI hardware stack.

How to Block MIDI Devices Access Globally

You can permanently sever the browser’s ability to execute Web MIDI requests via Chrome’s Site Settings.

1. Open the Google Chrome desktop browser.
2. Click the three vertical dots (⋮) in the top right corner and select Settings.
3. In the left-hand sidebar, click on Privacy and security.
4. In the main window, click on Site settings.
5. Scroll down to the “Permissions” heading and click to expand Additional permissions.
6. Click on MIDI devices.
7. Under the “Default behavior” heading, select the radio button for “Don’t allow sites to use MIDI devices” (or the equivalent restrictive option).

Total Audio Hardware Isolation

The change takes effect instantly. Google Chrome will completely terminate its background Web MIDI bridging daemon. The browser will instantly sever its connection to your operating system’s MIDI device enumeration stack. If a website attempts to execute an API call to scan for or communicate with connected electronic instruments, the request will instantly auto-reject in the background, returning a null value. This guarantees absolute audio hardware isolation, ensuring that untrusted web code cannot leverage your browser as a conduit to interface with or fingerprint your studio equipment.