Is Premium Sender - Rocket Sender for WA safe?
Premium Sender - Rocket Sender for WhatsApp sends WhatsApp page telemetry and link-preview URLs to external services.
The extension injects code on WhatsApp Web that sends page URL, referrer, title, session details, and event telemetry to Google Analytics. When extension-driven WhatsApp messages contain links, its link-preview helper can send those URLs to configured preview API hosts so preview metadata can be attached.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Persistent Google Analytics ID tracks your WhatsApp Web sessions
Every time you open WhatsApp Web, the extension's injected script creates a permanent tracking ID and beacons it to Google Analytics with the page URL.
We captured 8 of these requests across 4 page loads, all carrying the same ID.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open web.whatsapp.com with the extension installed.
content.js detects WhatsApp's app container and loads inject.js into the page.
The injected script creates a persistent tracking ID and sends it to Google Analytics along with your page URL.
navigator.sendBeacon posts the payload to analytics.google.com/g/collect on page load and on later interaction events.
- Client ID1612386731.1788908312
A random ID stored in localStorage that survives across sessions, letting Analytics link all your WhatsApp Web visits together.
- Page URLhttps://web.whatsapp.com/
The full address of the WhatsApp Web page you have open.
- Referrerhttps://web.whatsapp.com/
The page you arrived from, if the browser recorded one.
- Browser languageen-us
Your browser's language setting, added to your analytics profile.
- Screen resolution1920x1080
Your screen size, one more attribute used to distinguish your device.
- Analytics property IDG-MTQ4KY110F
Identifies this extension's own Google Analytics property, so its developer can see aggregated usage across every installed user.
Client ID generation and the Analytics request header (inject.js)
Persistent client ID + request header
inject.jsclass a { static get clientState() { const e = !localStorage.cid, t = localStorage.cid || sessionStorage.cid || i(1e9) + "." + Math.floor(Date.now() / 1e3); return localStorage.cid = sessionStorage.cid = t, { firstVisit: e, cid: t } } constructor(e) { this.trackingId = e, this.events = [], this.userProperties = {}, this.lastTime = Date.now(), this.hitsCount = 1, this.documentTitle = "" } get sid() { const e = `${this.trackingId}_sid`, t = sessionStorage[e] || Math.floor(Date.now() / 1e3); return sessionStorage[e] = t, t } get sct() { const e = `${this.trackingId}_sct`; let t = parseInt(localStorage[e]); return isNaN(t) && (t = 0), localStorage[e] = t + 1, localStorage[e] } getHeader() { const { cid: e, firstVisit: t } = a.clientState; return { v: 2, tid: this.trackingId, _p: a.pageLoadHash, cid: e, _fv: t ? 1 : void 0, ul: (navigator.language || "").toLowerCase() || void 0, sr: `${screen.width}x${screen.height}`, _s: this.hitsCount++, sid: this.sid, sct: this.sct, seg: 1, dl: location.href, dr: document.referrer, dt: this.documentTitle || document.title } }Beacon transmission
inject.jsprocessEvents() { const e = this.events; if (this.events = [], !e.length) return; const t = e.map((([e, t, r]) => { const n = []; if (n.push(["en", e]), n.push(["_ee", "1"]), t) for (const o in t) { const e = t[o]; void 0 !== e && ("number" == typeof e ? n.push([`epn.${o}`, String(e)]) : n.push([`ep.${o}`, String(e)])) } return n.push(["_et", String(r)]), n })), r = Object.entries(this.getHeader()).filter((([, e]) => void 0 !== e)).map((([e, t]) => [e, String(t)])); r.push(...this.getUserProperties()); const n = new URLSearchParams(r); if (1 === t.length) { for (const [e, r] of t[0]) n.append(e, r); navigator.sendBeacon(`${a.collectURL}?${n.toString()}`) } else { const e = t.map((e => new URLSearchParams(e).toString())); navigator.sendBeacon(`${a.collectURL}?${n.toString()}`, e.join("\n")) }}// a.collectURL is set once, at module load:t.Tracker = a, a.collectURL = "https://analytics.google.com/g/collect"204 No Content (sendBeacon is fire-and-forget; the extension does not read the response).
en=page_view&_ee=1&_et=842- analytics.google.com
Google's Analytics collection endpoint. Receives the persistent client ID, page URL, referrer, and device details from every WhatsApp Web session the extension is active in.
The bundled analytics library defines a disableGoogleAnalytics flag that would suppress every beacon in this claim, but it is not wired to any setting in the extension's own popup or options pages, so it stays off.
Where it sends data
Destinations our analysis observed Premium Sender - Rocket Sender for WA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- analytics.google.comwidely used
Premium Sender - Rocket Sender for WA sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.
- wajsapi.titanchat.com.br
Premium Sender - Rocket Sender for WA sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.
- wppc-linkpreview.cloudtrix.com.br
Premium Sender - Rocket Sender for WA sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.
- cobrancas.uppermesh.com.br
Premium Sender - Rocket Sender for WA sends data to cobrancas.uppermesh.com.br. 8 other extensions we have analysed send data here.