Is Sales Boost Connect safe?

Medium risk

Sales Boost Connect sends your WhatsApp number, profile name and Chrome email to wa-web-plus.web.app.

When WhatsApp Web loads, the extension reads the logged-in WhatsApp phone number and profile name, and also reads the Chrome profile email. It sends these, with the extension version, to its own server without any prompt or visible notice. A separate event sends the phone number and extension details to a reference endpoint on the same host.

The Digitalifyv4.9.1.10Chrome Web Store
49Risk
Who publishes it

The Digitalify - 4 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
The Digitalify
Website
soletstalkapp.com/contact-us/

Same store account

4 other listings published from this account, 2k+ users between them. 3 of them carry a finding.

WA Blaster2k+MediumBizLead Pro57MediumLeadGen Master4LowLeadMagnet Plus3Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Web Plus sends your number, name and Chrome email to its server

Code analysis shows that on WhatsApp Web load, your number, profile name and Chrome profile email are sent to wa-web-plus.web.app once per number, with no prompt in the code.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open WhatsApp Web in a tab.

No click or consent step is required.

The extension did this

The extension sends your number, name and Chrome email to wa-web-plus.web.app.

Sent once per WhatsApp number.

Query parameters of the /auth-user request
  • WhatsApp number
    447700900123

    The phone number of the account logged in to WhatsApp Web.

  • Profile name
    Alex Morgan

    The display name on your WhatsApp profile.

  • Chrome email
    alex.morgan@example.com

    Email of the Google account signed in to Chrome.

  • Extension version
    4.9.1.10

    Version string of the installed extension.

The code that does this

Service worker handler for the authUser message

Readable version

Page script reads the logged-in user and fires the event once per number

app.js
a = O.User?.getMaybeMePnUser() || O.User?.getMaybeMeLidUser();N.get("authed-" + a.user) ||  ((n = O.Contact.where({ isMe: !0 })),  (r = new CustomEvent("authUser", {    detail: { u: a.user, n: n[0]?.name || "" },  })),  window.dispatchEvent(r),  N.set("authed-" + a.user, !0));

Content script relays the event to the worker

bundle.js
window.addEventListener(  "authUser",  async function (e) {    chrome.runtime.sendMessage({ type: "authUser", obj: e.detail });  },  !1)
Destination hosts for this data
    • wa-web-plus.web.app

    Receives /auth-user, /save-reference (number) and /triplo-user (same trio, after a promo dialog click).

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Sales Boost Connect contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wa-web-plus.web.app

    Sales Boost Connect sends data to wa-web-plus.web.app. 6 other extensions we have analysed send data here.

Updated 15 October 2026jlceklkniomfeedjfkkdaabggnkpfpai