Is Total Privacy For WhatsApp Web - Whatsapp extra privacy safe?

Medium risk

Total Privacy For WhatsApp Web requests ads.brainosia.com from every page a user opens.

The extension registers a content script on all websites and automatically requests ads.brainosia.com/data.json whenever a page loads. That request can include page-context metadata such as the visited site's origin or referrer before the user takes any action.

extv3.1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every page load requests ads.brainosia.com data endpoint

When you visit any page, the extension's content script sends a GET request to ads.brainosia.com/data.json.

Running on every origin, this can expose your browsing URL, referrer, and request headers to that third party.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open or navigate to a webpage.

The extension did this

The extension's all-sites content script immediately requests ads.brainosia.com/data.json before any user action.

Captured request
GEThttps://ads.brainosia.com/data.json
Fields in the request
  • Your browsing URL
    https://example.com/account (illustrative)

    Shows which page context caused the extension request.

  • Referrer page
    https://example.com/search (illustrative)

    Can reveal the page or site visited immediately before the current request.

  • Browsing-history context
    A sequence of page visits during browsing (illustrative)

    Repeated automatic requests can associate visits across pages with the remote host.

  • Request headers
    User-Agent: Chrome/... (illustrative)

    Headers can include browser and page-request metadata sent with the network request.

What it can do

Permissions this extension asks for, as declared in version 3.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on web.whatsapp.com

    https://web.whatsapp.com/

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Total Privacy For WhatsApp Web - Whatsapp extra privacy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ads.brainosia.com

    Total Privacy For WhatsApp Web - Whatsapp extra privacy sends data to ads.brainosia.com. One other extension we have analysed sends data here.

Updated 21 September 2026ahfbjljipkpgbknoognlpekjkpmibgkf