Is Premium Sender - Rocket Sender for WA safe?

Medium risk

Premium Sender - Rocket Sender for WhatsApp sends WhatsApp page telemetry and link-preview URLs to external services.

The extension injects code on WhatsApp Web that sends page URL, referrer, title, session details, and event telemetry to Google Analytics. When extension-driven WhatsApp messages contain links, its link-preview helper can send those URLs to configured preview API hosts so preview metadata can be attached.

premium-senderv2.0.45Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Persistent Google Analytics ID tracks your WhatsApp Web sessions

Every time you open WhatsApp Web, the extension's injected script creates a permanent tracking ID and beacons it to Google Analytics with the page URL.

We captured 8 of these requests across 4 page loads, all carrying the same ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open web.whatsapp.com with the extension installed.

content.js detects WhatsApp's app container and loads inject.js into the page.

The extension did this

The injected script creates a persistent tracking ID and sends it to Google Analytics along with your page URL.

navigator.sendBeacon posts the payload to analytics.google.com/g/collect on page load and on later interaction events.

Fields sent to Google Analytics on each beacon
  • Client ID
    1612386731.1788908312

    A random ID stored in localStorage that survives across sessions, letting Analytics link all your WhatsApp Web visits together.

  • Page URL
    https://web.whatsapp.com/

    The full address of the WhatsApp Web page you have open.

  • Referrer
    https://web.whatsapp.com/

    The page you arrived from, if the browser recorded one.

  • Browser language
    en-us

    Your browser's language setting, added to your analytics profile.

  • Screen resolution
    1920x1080

    Your screen size, one more attribute used to distinguish your device.

  • Analytics property ID
    G-MTQ4KY110F

    Identifies this extension's own Google Analytics property, so its developer can see aggregated usage across every installed user.

The code that does this

Client ID generation and the Analytics request header (inject.js)

Readable version

Persistent client ID + request header

inject.js
class a {  static get clientState() {    const e = !localStorage.cid,      t = localStorage.cid || sessionStorage.cid || i(1e9) + "." + Math.floor(Date.now() / 1e3);    return localStorage.cid = sessionStorage.cid = t, {      firstVisit: e,      cid: t    }  }  constructor(e) {    this.trackingId = e, this.events = [], this.userProperties = {}, this.lastTime = Date.now(), this.hitsCount = 1, this.documentTitle = ""  }  get sid() {    const e = `${this.trackingId}_sid`,      t = sessionStorage[e] || Math.floor(Date.now() / 1e3);    return sessionStorage[e] = t, t  }  get sct() {    const e = `${this.trackingId}_sct`;    let t = parseInt(localStorage[e]);    return isNaN(t) && (t = 0), localStorage[e] = t + 1, localStorage[e]  }  getHeader() {    const {      cid: e,      firstVisit: t    } = a.clientState;    return {      v: 2,      tid: this.trackingId,      _p: a.pageLoadHash,      cid: e,      _fv: t ? 1 : void 0,      ul: (navigator.language || "").toLowerCase() || void 0,      sr: `${screen.width}x${screen.height}`,      _s: this.hitsCount++,      sid: this.sid,      sct: this.sct,      seg: 1,      dl: location.href,      dr: document.referrer,      dt: this.documentTitle || document.title    }  }

Beacon transmission

inject.js
processEvents() {  const e = this.events;  if (this.events = [], !e.length) return;  const t = e.map((([e, t, r]) => {      const n = [];      if (n.push(["en", e]), n.push(["_ee", "1"]), t)        for (const o in t) {          const e = t[o];          void 0 !== e && ("number" == typeof e ? n.push([`epn.${o}`, String(e)]) : n.push([`ep.${o}`, String(e)]))        }      return n.push(["_et", String(r)]), n    })),    r = Object.entries(this.getHeader()).filter((([, e]) => void 0 !== e)).map((([e, t]) => [e, String(t)]));  r.push(...this.getUserProperties());  const n = new URLSearchParams(r);  if (1 === t.length) {    for (const [e, r] of t[0]) n.append(e, r);    navigator.sendBeacon(`${a.collectURL}?${n.toString()}`)  } else {    const e = t.map((e => new URLSearchParams(e).toString()));    navigator.sendBeacon(`${a.collectURL}?${n.toString()}`, e.join("\n"))  }}// a.collectURL is set once, at module load:t.Tracker = a, a.collectURL = "https://analytics.google.com/g/collect"
Captured request
POSThttps://analytics.google.com/g/collect?v=2&tid=G-MTQ4KY110F&cid=1612386731.1788908312&ul=en-us&sr=1920x1080&sid=1725830000&sct=3&seg=1&dl=https%3A%2F%2Fweb.whatsapp.com%2F&dr=https%3A%2F%2Fweb.whatsapp.com%2F&dt=WhatsApp

204 No Content (sendBeacon is fire-and-forget; the extension does not read the response).

Body
en=page_view&_ee=1&_et=842
Where this data ends up
    • analytics.google.com

    Google's Analytics collection endpoint. Receives the persistent client ID, page URL, referrer, and device details from every WhatsApp Web session the extension is active in.

No opt-out in the extension itself

The bundled analytics library defines a disableGoogleAnalytics flag that would suppress every beacon in this claim, but it is not wired to any setting in the extension's own popup or options pages, so it stays off.

Where it sends data

Destinations our analysis observed Premium Sender - Rocket Sender for WA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    Premium Sender - Rocket Sender for WA sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

  • wajsapi.titanchat.com.br

    Premium Sender - Rocket Sender for WA sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    Premium Sender - Rocket Sender for WA sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • cobrancas.uppermesh.com.br

    Premium Sender - Rocket Sender for WA sends data to cobrancas.uppermesh.com.br. 8 other extensions we have analysed send data here.

Updated 30 September 2026bfldbakgnmlkcjpfchepcadilflcnipc