Is LeadMagnet Plus safe?

Medium risk

LeadMagnet Plus sends your WhatsApp number, profile name and Chrome email to wa-web-plus.web.app when WhatsApp Web loads.

When WhatsApp Web opens, the extension reads the logged-in phone number and profile name from the page and the Chrome profile email through the identity permission. It sends these to its own server once per number, with no consent prompt. A second request sends the phone number and the extension ID.

The Digitalifyv4.9.1.10Chrome Web Store
49Risk
Who publishes it

The Digitalify - 4 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
The Digitalify
Website
soletstalkapp.com/contact-us/

Same store account

4 other listings published from this account, 2k+ users between them. 3 of them carry a finding.

WA Blaster2k+MediumBizLead Pro57MediumLeadGen Master4LowSales Boost Connect1Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Web extension sends your number, name and Chrome email to its server

Code analysis shows that when WhatsApp Web loads, the extension sends your WhatsApp number, profile name and Chrome profile email to wa-web-plus.web.app, once per number, without a consent prompt.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open WhatsApp Web while signed in to Chrome.

The extension did this

The extension sends your WhatsApp number, name and Chrome email to wa-web-plus.web.app.

Query parameters of the auth-user request
  • WhatsApp number
    u=447700900123

    Ties the request to your WhatsApp account.

  • Profile name
    n=Jane Smith

    The name shown on your WhatsApp profile.

  • Chrome profile email
    e=jane.smith@example.com

    The address of the Google account signed in to Chrome.

  • Extension version
    v=4.9.1.10

    Identifies which build sent the request.

The code that does this

Page script reads identity; worker adds Chrome email and sends it

Readable version

Service worker handler

worker.js
"authUser" == r.type ? chrome.identity.getProfileUserInfo(function(e) {  t(e.email), fetch("https://wa-web-plus.web.app/auth-user?t=" + Math.random() + "&u=" + r.obj?.u + "&n=" + r.obj?.n + "&e=" + e.email + "&v=" + s.version)}) : "triploUser" == r.type ? chrome.identity.getProfileUserInfo(function(e) {  t(e.email), fetch("https://wa-web-plus.web.app/triplo-user?t=" + Math.random() + "&u=" + r.obj?.u + "&n=" + r.obj?.n + "&e=" + e.email + "&v=" + s.version)})
Destination
    • wa-web-plus.web.app

    Vendor Firebase host; receives auth-user, triplo-user and save-reference GET requests.

Check if you're affected

Searches an unpacked copy of the extension for the three endpoints that carry the phone number, name and email.

Requires
  • sh
  • grep
find_wa_web_plus_calls.sh · sh
#!/bin/sh# usage: ./find_wa_web_plus_calls.sh /path/to/unpacked/extensiongrep -n "wa-web-plus.web.app/\(auth-user\|triplo-user\|save-reference\)" "$1"/worker.jsgrep -n "getProfileUserInfo" "$1"/worker.js
How to run it
  1. 1Unpack the CRX.
  2. 2Run the script with the unpacked folder.
  3. 3Confirm worker.js builds the URLs from the number, name and email.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed LeadMagnet Plus contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wa-web-plus.web.app

    LeadMagnet Plus sends data to wa-web-plus.web.app. 6 other extensions we have analysed send data here.

Updated 15 October 2026kcgcknjnagmmfimcplkbbkgphhbfnphn