Is Number Checker for WhatsApp – Validate, Search & Lookup safe?

Medium risk

Number Checker for WhatsApp sends typed WhatsApp message URLs to third-party link preview services.

When WhatsApp generates a link preview, the extension's injected helper wraps that preview function and reads the URL being previewed. It sends the URL to configured preview services so they can fetch preview data and thumbnails outside WhatsApp's normal flow.

charlesgarcia3245v1.2.12Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp message URLs sent to third-party preview services

When you type or paste a URL into WhatsApp, the extension's injected helper rewrites link-preview handling and sends the URL to third-party endpoints: cobrancas.uppermesh.com.br, wajsapi.titanchat.com.br, wppc-linkpreview.cloudtrix.com.br.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

A user action in WhatsApp triggers link preview generation for a typed or pasted URL.

The extension did this

The extension's injected WhatsApp helper rewrites preview generation and sends the URL to third-party preview services.

Captured request
GEThttps://cobrancas.uppermesh.com.br:8000/v1/link-preview/fetch-data.png?url=, https://wajsapi.titanchat.com.br/v1/link-preview/fetch-data.png?url=, https://wppc-linkpreview.cloudtrix.com.br/v1/link-preview/fetch-data.png?url=
Fields in the request
  • Your message URL
    https://example.com/article

    The URL you typed or pasted in WhatsApp is sent to a third-party preview service so it can fetch preview data.

Observation

Dynamic analysis confirmed that the extension registers the WhatsApp helper in the page context and that the helper wraps WhatsApp's link preview function before requesting the third-party preview endpoints.

Where it sends data

Destinations our analysis observed Number Checker for WhatsApp – Validate, Search & Lookup contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wajsapi.titanchat.com.br

    Number Checker for WhatsApp – Validate, Search & Lookup sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    Number Checker for WhatsApp – Validate, Search & Lookup sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • cobrancas.uppermesh.com.br

    Number Checker for WhatsApp – Validate, Search & Lookup sends data to cobrancas.uppermesh.com.br. 8 other extensions we have analysed send data here.

Updated 21 September 2026elglipbjpkoapgnaomjcmcpkioefphgj