Is DealsUpp - Contact Saver for WA safe?

Medium risk

DealsUpp - Contact Saver for WA injects a WhatsApp helper that sends page and session telemetry to Google Analytics.

On WhatsApp Web, the injected script creates or reuses local and session storage IDs and sends beacons to analytics.google.com/g/collect. Those events include the current WhatsApp URL, referrer, page title, browser language, screen size, session IDs, and login/logout connection events.

sw680396v2.0.14Chrome Web Store
45Risk
Who publishes it

sw680396 - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sw680396

Same store account

1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.

WA Message Sending Bot10k+Medium

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

extension-center.com
Also called by 3 other listings: WA Bulk Message Sender Extension, WA Group Number Exporter, DealsUpp WA Sender - Bulk Messages Automation Tool

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp helper library reports your page visits and logins to Google Analytics

Every time you open WhatsApp Web, a script the extension injects sends the page URL, title, and a persistent tracking ID to Google Analytics.

It also sends separate events when you log in or out of WhatsApp.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open or reload WhatsApp Web with the extension installed.

The tab loads https://web.whatsapp.com/ while the extension is enabled.

The extension did this

A script the extension injects into the page sends your page URL, title, and a persistent tracking ID to Google Analytics.

The call fires from the page context via navigator.sendBeacon, independent of the extension's own popup UI.

What each beacon carries
  • The page you're viewing
    https://web.whatsapp.com/

    The full URL of the WhatsApp Web tab at the moment the beacon fires.

  • Page title
    W: -, WA-JS: 3.19.7

    The browser tab title, which also encodes the WA-JS library version.

  • Persistent client ID
    1015001216.1788898355

    A random ID generated once and stored in localStorage so Google Analytics can link every future visit to the same browser.

  • Screen size and language
    1512x982, en-gb

    Your screen resolution and browser language, added to every beacon as device context.

  • Login and logout events
    en=login, up.method=multidevice

    A labeled event naming your WhatsApp connection method, sent whenever you log in or out.

Captured request
POSThttps://analytics.google.com/g/collect?v=2&tid=G-MTQ4KY110F&_p=994929765&cid=1015001216.1788898355&ul=en-gb&sr=1512x982&_s=1&sid=1788898386&sct=2&seg=1&dl=https%3A%2F%2Fweb.whatsapp.com%2F&dr=&dt=W%3A+-%2C+WA-JS%3A+3.19.7&up.method=multidevice&up.wa_js=3.19.7&up.powered_by=WA-JS
The code that does this

The bundled Tracker class that builds and sends each beacon

Readable version

Beacon header and client ID (renamed)

class GaTracker {    static get clientState() {        const isFirstVisit = !localStorage.cid;        const clientId = localStorage.cid || sessionStorage.cid            || randomInt(1e9) + "." + Math.floor(Date.now() / 1000);        localStorage.cid = sessionStorage.cid = clientId;        return {firstVisit: isFirstVisit, cid: clientId};    }    getHeader() {        const {cid, firstVisit} = GaTracker.clientState;        return {            v: 2,            tid: this.trackingId,          // GA measurement ID: G-MTQ4KY110F            cid,                           // persistent per-browser client ID            ul: navigator.language,            sr: `${screen.width}x${screen.height}`,            dl: location.href,             // full URL of the WhatsApp Web tab            dr: document.referrer,            dt: this.documentTitle || document.title        };    }}

Sending the beacon and hooking login/logout (renamed)

navigator.sendBeacon(`${GaTracker.collectURL}?${params.toString()}`);GaTracker.collectURL = "https://analytics.google.com/g/collect";internalEvents.on("conn.authenticated", () => {    const method = isMultiDevice() ? "multidevice" : "legacy";    tracker.trackEvent("login", {method});});internalEvents.on("conn.logout", () => {    const method = isMultiDevice() ? "multidevice" : "legacy";    tracker.trackEvent("logout", {method});});
Where the data ends up
    • analytics.google.com

    Google's Analytics collection endpoint. Receives the page URL, title, screen size, language, and a persistent client ID on every WhatsApp Web page load, login, and logout.

Where it sends data

Destinations our analysis observed DealsUpp - Contact Saver for WA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    DealsUpp - Contact Saver for WA sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

Updated 30 September 2026pfomiledcpfnldnldlffdebbpjnhkbbl