Is Premium Sender safe?
Premium Sender is medium risk. Opening the Premium Sender popup with WhatsApp loaded fetches CSS selectors from premiumsender.app. A captured GET to /mv3/dom-selectors.php returned an AES-encrypted payload decrypting to eight selectors, including send/attachment/input.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-Controlled DOM Selectors Injected into WhatsApp
Opening the Premium Sender popup with WhatsApp loaded fetches CSS selectors from premiumsender.app.
A captured GET to /mv3/dom-selectors.php returned an AES-encrypted payload decrypting to eight selectors, including send/attachment/input.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open the Premium Sender popup while WhatsApp is open in a tab.
The extension immediately fetches a set of CSS selectors from its server and pushes them into your active WhatsApp tab.
The selectors tell the extension's in-page script which HTML elements map to the send button, message input, attachment button, and other WhatsApp UI controls, and the server can change them at any time.
HTTP 200 OK. Body: AES-256-CBC ciphertext (base64). Decrypts to JSON with 8 WhatsApp CSS selectors including SELECTOR_SEND_BUTTON=[data-icon='send'], SELECTOR_ADD_ATTACHMENT_BUTTON, and the message input field selector.
The server's response is AES-encrypted before transit. It looks like random base64 in your browser's network tab. Using the hardcoded key embedded in the extension source, it decodes to a JSON object with WhatsApp UI selectors.
{ "SELECTOR_SEND_BUTTON": "[data-icon='send']", "SELECTOR_ADD_ATTACHMENT_BUTTON": "[data-icon='attach-menu-plus']", "SELECTOR_MSG_BOX": "div[contenteditable='true'][data-tab='10']", "SELECTOR_MAIN_PANEL": "#main", "SELECTOR_CONTACT_TITLE": "header span[title]", "SELECTOR_MSG_SEND_STATUS": "span[data-icon='msg-time']", "SELECTOR_FILE_INPUT": "input[type='file']", "SELECTOR_CLOSE_BTN": "[data-icon='x']"}The popup startup code that fetches and injects server-controlled selectors.
iO: fetches and decrypts the server-side selector list
// Fetches CSS selectors from the server and decrypts them.async function fetchDomSelectors() { try { // GET https://premiumsender.app/mv3/dom-selectors.php const response = await httpGet(BASE_URL + '/dom-selectors.php'); // lO() decrypts AES-256-CBC using hardcoded key/IV return JSON.parse(aesDecrypt(response.data)); } catch (e) { console.error('Error in getting DomSelectors:', e); return null; }}rO: startup routine that injects the fetched selectors into the WhatsApp tab
// Runs at popup load. Pushes server-fetched selectors into the active WhatsApp tab.const selectors = await fetchDomSelectors(); // remote configconst activeTab = await getActiveWhatsAppTab();chrome.scripting.executeScript({ target: { tabId: activeTab.id }, func: (selectorMap) => { // Runs in the WhatsApp page's MAIN world if (window.psLib && window.psLib.updateDS) { window.psLib.updateDS(selectorMap); } }, args: [selectors], world: 'MAIN'});- premiumsender.app
Premium Sender's own backend. Supplies the CSS selector map used against WhatsApp's DOM. Any response change takes effect in all users' browsers without an extension update.