Is WA Bulk Message Sender Extension safe?
WA Bulk Message Sender Extension sends WhatsApp Web telemetry to Google Analytics and message-preview URLs to preview servers.
On WhatsApp Web, injected WA-JS code builds Google Analytics beacons that include a generated client ID, page URL, referrer, title, language, screen size, and session counters. When WhatsApp generates link previews, the wrapper sends the preview URL, and sometimes the preview image URL, to one of three configured preview API servers.
Who publishes ityourdie2710 - 2 other listings from the same operator, 1 of them carrying a finding
yourdie2710 - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 12k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp message URLs are sent to third-party link preview services.
Using WhatsApp through WA Bulk Message Sender, its link-preview wrapper extracts URLs from message previews and sends them to services at cobrancas.uppermesh.com.br, wajsapi.titanchat.com.br, or wppc-linkpreview.cloudtrix.com.br.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user uses WhatsApp Web in a flow that generates a message link preview.
The extension extracts the preview URL and sends it to third-party link-preview services.
- WhatsApp message URLhttps://example.com/article (illustrative)
The URL from a WhatsApp message can reveal the site, article, file, or other content being shared in that conversation.
Verification confirmed that the extension injects on WhatsApp Web, wraps WhatsApp's link-preview generation, and builds third-party fetch and image-download requests for preview URLs.
WA Bulk Message Sender beacons your WhatsApp Web activity to Google Analytics
Every time you open web.whatsapp.com, the extension injects a script that sends the page URL, referrer, title, language, and screen size to Google Analytics.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open web.whatsapp.com with the extension installed and enabled.
The extension injects wa.js, which reports your page activity to Google Analytics with no consent prompt or visible setting.
This happens on every page load, whether or not you send a bulk message.
- Page URLhttps://web.whatsapp.com/
The exact WhatsApp Web page you're on, sent on every load.
- Referrerhttps://www.google.com/
The page you arrived from, if any.
- Page titleWhatsApp
The browser tab's title text at the time of the beacon.
- Client ID1008095434.1788894643
A random ID stored in your browser that ties every future visit back to this one.
- Browser languageen-us
Your browser's configured language.
- Screen size800x600
Your screen resolution, used with the other fields to narrow down your device.
204 No Content, consistent with a standard GA4 Measurement Protocol hit.
en=user_engagement&_ee=1&_et=1200The beacon is unconditional: disableGoogleAnalytics defaults to false
disableGoogleAnalytics: false,Every page hit builds a query string of page state and beacons it to Google
buildAnalyticsHeader() { const {clientId, firstVisit} = Tracker.clientState; return { version: 2, trackingId: this.trackingId, pageLoadHash: Tracker.pageLoadHash, clientId, firstVisit: firstVisit ? 1 : undefined, language: (navigator.language || "").toLowerCase() || undefined, screenResolution: `${screen.width}x${screen.height}`, hitSequence: this.hitsCount++, sessionId: this.sessionId, sessionCount: this.sessionCount, pageUrl: location.href, referrer: document.referrer, pageTitle: this.documentTitle || document.title }}navigator.sendBeacon(`${Tracker.collectURL}?${params.toString()}`)- analytics.google.com
Google Analytics 4 Measurement Protocol endpoint; receives the page URL, referrer, title, client ID, language, and screen size on every WhatsApp Web page load.
Where it sends data
Destinations our analysis observed WA Bulk Message Sender Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- analytics.google.comwidely used
WA Bulk Message Sender Extension sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.
- wajsapi.titanchat.com.br
WA Bulk Message Sender Extension sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.
- wppc-linkpreview.cloudtrix.com.br
WA Bulk Message Sender Extension sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.
- cobrancas.uppermesh.com.br:8000
WA Bulk Message Sender Extension sends data to cobrancas.uppermesh.com.br:8000. 2 other extensions we have analysed send data here.