Is WA Message Sending Bot safe?
WA Message Sending Bot sends WhatsApp page analytics and a persistent client ID to Google Analytics.
WA Message Sending Bot injects an automation library into WhatsApp pages that reports analytics events to Google Analytics. The reported data includes a persistent client ID, the current page URL, referrer, page title, language, screen size, WhatsApp version, and login or engagement status.
Who publishes itsw680396 - 1 other listing from the same operator, 1 of them carrying a finding
sw680396 - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp automation extension sends persistent tracking ID to Google Analytics
Opening WhatsApp Web makes the extension's injected wa.js library create a persistent tracking ID and send it, plus the page URL and title, to Google Analytics with no consent prompt.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
Opens web.whatsapp.com with an active or QR-login WhatsApp session.
The extension's content script is already registered on every whatsapp.com page.
The injected wa.js library creates a persistent tracking ID and sends it, the page URL, and the page title to Google Analytics.
The beacon fires automatically, before any interaction with the page and with no consent prompt in the extension's own UI.
204 No Content. Standard Google Analytics Measurement Protocol acknowledgment, no response body.
en=user_engagement&_ee=1&_et=1474- Persistent client ID1753450314.1788879464
A unique ID stored in your browser that links every WhatsApp Web visit to the same identity over time.
- Page addresshttps://web.whatsapp.com/
The full WhatsApp Web URL open when the beacon fires.
- Page title and app versionW: 2.3000.1046973889, WA-JS: 4.5.0
The tab title, set by the library to include the WhatsApp Web and wa-js version numbers.
- Login statusauthenticated=true
Whether you are currently signed in to WhatsApp Web in this browser session.
- Event nameen=login
Which action triggered the beacon: page view, login, logout, or ongoing engagement.
wa.js's Tracker class builds the persistent client ID and beacons it via sendBeacon
Client ID creation and analytics header fields
wa.jsclass Tracker { static get clientState() { const isFirstVisit = !localStorage.cid; const clientId = localStorage.cid || sessionStorage.cid || randomInt(1e9) + "." + Math.floor(Date.now() / 1000); localStorage.cid = sessionStorage.cid = clientId; return { firstVisit: isFirstVisit, cid: clientId }; } constructor(trackingId) { this.trackingId = trackingId; this.events = []; this.userProperties = {}; this.lastTime = Date.now(); this.hitsCount = 1; this.documentTitle = ""; } get sid() { const key = `${this.trackingId}_sid`; const value = sessionStorage[key] || Math.floor(Date.now() / 1000); return sessionStorage[key] = value, value; } get sct() { const key = `${this.trackingId}_sct`; let count = parseInt(localStorage[key]); if (isNaN(count)) count = 0; return localStorage[key] = count + 1, localStorage[key]; } getHeader() { const { cid, firstVisit } = Tracker.clientState; return { v: 2, tid: this.trackingId, // Google Analytics measurement ID cid, // the persistent client ID _fv: firstVisit ? 1 : undefined, ul: (navigator.language || "").toLowerCase() || undefined, sr: `${screen.width}x${screen.height}`, sid: this.sid, sct: this.sct, dl: location.href, // full page URL dr: document.referrer, dt: this.documentTitle || document.title }; }}processEvents() serializes the header and events, then calls sendBeacon
wa.jsprocessEvents() { const events = this.events; if (this.events = [], !events.length) return; const eventParams = events.map(([name, props, elapsed]) => { const pairs = [["en", name], ["_ee", "1"]]; for (const key in props) { pairs.push([`ep.${key}`, String(props[key])]); } pairs.push(["_et", String(elapsed)]); return pairs; }); const headerParams = Object.entries(this.getHeader()) .filter(([, v]) => v !== undefined) .map(([k, v]) => [k, String(v)]); const query = new URLSearchParams(headerParams); // Beacon fires with no user interaction and no consent prompt. navigator.sendBeacon(`${Tracker.collectURL}?${query}`);}Tracker instantiated with Google's measurement ID unless config disables it
wa.jsTracker.collectURL = "https://analytics.google.com/g/collect";// One Tracker per WhatsApp page load, hardcoded to this extension's// Google Analytics property, gated only by an internal config flag.const primaryTracker = new Tracker("G-MTQ4KY110F");- analytics.google.com
Google's Measurement Protocol endpoint. Receives the client ID, page URL, referrer, and title on every WhatsApp Web page load.
Where it sends data
Destinations our analysis observed WA Message Sending Bot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- analytics.google.comwidely used
WA Message Sending Bot sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.