Is WA Filter & Number Checker: Check & Verify WhatsApp Numbers safe?
WA Filter & Number Checker sends your Google profile email and WhatsApp number to its backend.
When the popup opens on WhatsApp Web, it reads the WhatsApp account number from page storage and gets the signed-in Chrome profile email. It posts those values to the vendor backend, while an injected WhatsApp script also sends page URL, referrer, title, language, screen size, and persistent client identifiers to Google Analytics.
Who publishes itrahul - 3 other listings from the same operator, 1 of them carrying a finding
rahul - 3 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 14k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup sends Chrome profile email and WhatsApp number on open
Opening the popup, the extension reads your WhatsApp account number from web.whatsapp.com and your Chrome profile email, then sends both to wa-filter-2a2416e8fac0.herokuapp.com/api/user and stores the response as USER.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user opens or uses the extension popup.
The extension reads the WhatsApp account number from the active web.whatsapp.com tab, reads the Chrome profile email, and sends both values to the vendor backend.
- Browser storage data+15551234567 (illustrative)
The WhatsApp account number read from web.whatsapp.com storage, which can identify the WhatsApp account tied to this session.
Where it sends data
Destinations our analysis observed WA Filter & Number Checker: Check & Verify WhatsApp Numbers contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- analytics.google.comwidely used
WA Filter & Number Checker: Check & Verify WhatsApp Numbers sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.
- wa-filter-2a2416e8fac0.herokuapp.com
WA Filter & Number Checker: Check & Verify WhatsApp Numbers sends data to wa-filter-2a2416e8fac0.herokuapp.com. No other extension we have analysed sends data here.