Is Privacy for WhatsApp Web safe?

Question

Accepted Answer

Privacy for WhatsApp Web is medium risk. Each time the extension starts, it fetches gzip-compressed configuration from https://ext.leadsext.com/crx/cjj2. Our dynamic analysis captured this request and found the response contains 9,400+ characters of JSON stored in chrome.storage.local as dockingInfo. The config directly controls which DOM selectors the extension targets on WhatsApp Web, which CSS styles are injected per user privacy toggle, and which promotional banners are shown — allowing these behaviors to be altered remotely without a Chrome Web Store update. When the extension is installed, it generates a UUID and stores it permanently in chrome.storage.sync. Our dynamic analysis captured a POST to https://ext.leadsext.com/crx/in carrying that UUID, a Google OAuth client ID, and a timestamp. The server responds with a session token (crx_vcwgjg) that is attached as a header to every subsequent request, linking all future activity to the same pseudonymous profile across reinstalls.

Is Privacy Extension For WhatsApp Web - wabulk.net safe?

Findings