Is Moneybelfort safe?

Medium risk

Moneybelfort sends your WhatsApp number and Chrome profile email to aws-api-fp.averion.in on each WhatsApp Web load.

When WhatsApp Web loads and the extension has read your own WhatsApp number, it also reads the email of the Chrome profile and sends both to its plan-lookup server. The server's response can include banner text, which the extension inserts as unsanitized HTML into the WhatsApp Web page.

Staton digital enterprises v1.1Chrome Web Store
55Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Pro Sender sends your WhatsApp number and Chrome email to averion.in on load

Code analysis shows the extension sends your WhatsApp number and Chrome profile email to aws-api-fp.averion.in whenever WhatsApp Web loads.

The email is read through the identity permission.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open WhatsApp Web and the extension reads your own number.

The extension did this

It asks for your Chrome email and requests your plan from aws-api-fp.averion.in.

Query parameters of the plan request
  • Phone number
    phone=447700900123

    Your own WhatsApp number as read from WhatsApp Web.

  • Chrome profile email
    email=jane.doe@example.com

    Email of the Chrome profile account, when one is signed in.

The code that does this

Email lookup and request construction

Readable version

Endpoint constant

js/prodata.js
PLAN_FETCH: "https://aws-api-fp.averion.in/ps/fp",

Caller

js/procntt.js
chrome.runtime.sendMessage({ type: "get_chrome_email" }, function (response) {  let email = (response && response.email) ? response.email : "";  fetchPlan(email);});setTimeout(() => fetchPlan(""), 2000);
Destination of the request
    • aws-api-fp.averion.in

    Receives the phone number and email on the /ps/fp plan lookup endpoint.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Pro Sender inserts server-supplied banner text into WhatsApp Web as raw HTML

Code analysis shows bannerText from aws-api-fp.averion.in is stored and inserted into WhatsApp Web as unsanitized HTML.

Whoever controls that response can place links or forms on the page.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

The plan response sets showBanner to true with a bannerText value.

The extension did this

The extension shows that text as HTML at the top of your WhatsApp Web page.

The code that does this

Stored value interpolated into markup

Readable version

Banner rendering

js/procntt.js
<span class="banner-text">${res.bannerText}</span>...$("body").prepend(bannerHtml);
Fields controlling the banner
  • showBanner
    true

    Server flag that turns the banner on.

  • bannerText
    Plan expired. <a href="https://example.com/renew">Renew</a>

    Server text inserted into the page as HTML with no escaping.

Source of the banner content
    • aws-api-fp.averion.in

    Returns showBanner and bannerText in the /ps/fp plan response.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Moneybelfort contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • aws-api-fp.averion.in

    Moneybelfort sends data to aws-api-fp.averion.in. One other extension we have analysed sends data here.

Updated 15 October 2026oolalgmbhlnjefbbehmldcplgdheodaf