Is Prime Sender - Free WhatsApp Web Message Sender safe?

Medium risk

Prime Sender sends WhatsApp account details and Chrome profile email to vendor and analytics endpoints.

On WhatsApp Web, the content script reads the WhatsApp account number from local storage and obtains the Chrome profile email, then includes the number, email, and display name in a subscription-plan request. It also sends analytics events to Google Analytics with the WhatsApp number in the event label, and an installation geolocation fallback can request ip-api.com over HTTP.

Averionv5.0.7Chrome Web Store
49Risk
Who publishes it

Averion - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Averion
Website
prime-sender.net/contact

Same store account

1 other listing published from this account, 27 users between them, none of them carrying a finding.

Email Tracker + Tracking Pixel Blocker27Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Prime Sender reports your WhatsApp number to Google Analytics every visit

Every time you open WhatsApp Web, the extension reads your WhatsApp number from local storage and sends it to Google Analytics as event my_number.

We confirmed this with a planted test number captured in the request.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open WhatsApp Web with an active, logged-in session.

The extension's content script only runs on web.whatsapp.com.

The extension did this

It reads your WhatsApp account number from the page's local storage and reports it to Google Analytics.

This runs automatically on every page load, not just once.

What the analytics event carries
  • Your WhatsApp number
    +14155550142 (illustrative)

    Directly identifies your WhatsApp account and is resent on every page load.

  • Event name
    my_number

    Labels the payload so the developer's analytics dashboard can filter for account-identifying events.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-7NZHRMXLZM&api_secret=<redacted>

A planted test WhatsApp number reappeared verbatim in the request body of this POST, confirmed across repeated page loads.

Body
{  "events": [    {      "name": "my_number",      "params": {        "track": "+14155550142 (illustrative)",        "label": "+14155550142 free (illustrative)",        "session_id": "1725800000123",        "engagement_time_msec": 100      }    }  ]}
Where this data goes
    • www.google-analytics.com

    Google's own Measurement Protocol collection endpoint (Alphabet); receives the account-identifying event under the developer's analytics property.

What we did and didn't confirm

The same code path also sends the Chrome profile email in a separate logged_mail event. Our test session had no email on the profile, so it fired empty; we saw no populated email leave the device, though the code runs on every page load.

Prime Sender sends your WhatsApp number to its own subscription-plan API

Every time you open WhatsApp Web, the extension sends your WhatsApp account number in a plain GET request to its own subscription-plan server.

We confirmed this by planting a test number and watching it arrive at the endpoint.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open WhatsApp Web with an active, logged-in session.

The extension's content script only runs on web.whatsapp.com.

The extension did this

It sends your WhatsApp account number in the URL of a GET request to the developer's own subscription-plan server.

The number rides in the query string rather than an encrypted request body.

What the request carries
  • Your WhatsApp number
    +14155550142 (illustrative)

    Placed directly in the URL query string, where it can be captured by any system that logs URLs.

  • Request path
    /api/subscription/plan

    Identifies the vendor's own subscription/plan lookup service, not a third-party ad or analytics network.

Captured request
GEThttps://prime-sender-api.vercel.app/api/subscription/plan?phone=+14155550142 (illustrative)&email=&name=null

A planted test WhatsApp number reappeared verbatim in the phone query parameter, confirmed across repeated page loads.

Where this data goes
    • prime-sender-api.vercel.app

    The developer's own backend, hosted on Vercel; receives your WhatsApp number in plaintext query parameters to look up your subscription plan.

What we did and didn't confirm

This request is also designed to carry your Chrome profile email and WhatsApp display name as query parameters. Both were empty in our test session, so we did not directly observe populated values leaving the device for those fields.

What it can do

Permissions this extension asks for, as declared in version 5.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your bookmarks

    bookmarks

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Show you desktop notifications

    notifications

  • See the address and title of every tab you have open

    tabs

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed Prime Sender - Free WhatsApp Web Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Prime Sender - Free WhatsApp Web Message Sender sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • ip-api.comwidely used

    Prime Sender - Free WhatsApp Web Message Sender sends data to ip-api.com. A widely used service: 62 other extensions we have analysed send data here.

  • prime-sender-api.vercel.app

    Prime Sender - Free WhatsApp Web Message Sender sends data to prime-sender-api.vercel.app. No other extension we have analysed sends data here.

Updated 30 September 2026cioclaehpkkndohobfpdghgkaifaacgb