Is WA Message Sending Bot safe?

Medium risk

WA Message Sending Bot sends WhatsApp page analytics and a persistent client ID to Google Analytics.

WA Message Sending Bot injects an automation library into WhatsApp pages that reports analytics events to Google Analytics. The reported data includes a persistent client ID, the current page URL, referrer, page title, language, screen size, WhatsApp version, and login or engagement status.

sw680396v2.0.7Chrome Web Store
45Risk
Who publishes it

sw680396 - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sw680396

Same store account

1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp automation extension sends persistent tracking ID to Google Analytics

Opening WhatsApp Web makes the extension's injected wa.js library create a persistent tracking ID and send it, plus the page URL and title, to Google Analytics with no consent prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Opens web.whatsapp.com with an active or QR-login WhatsApp session.

The extension's content script is already registered on every whatsapp.com page.

The extension did this

The injected wa.js library creates a persistent tracking ID and sends it, the page URL, and the page title to Google Analytics.

The beacon fires automatically, before any interaction with the page and with no consent prompt in the extension's own UI.

Captured request
POSThttps://analytics.google.com/g/collect?v=2&tid=G-MTQ4KY110F&cid=1753450314.1788879464&dl=https%3A%2F%2Fweb.whatsapp.com%2F&dr=&dt=W%3A+2.3000.1046973889%2C+WA-JS%3A+4.5.0&en=user_engagement

204 No Content. Standard Google Analytics Measurement Protocol acknowledgment, no response body.

Body
en=user_engagement&_ee=1&_et=1474
What the beacon contains
  • Persistent client ID
    1753450314.1788879464

    A unique ID stored in your browser that links every WhatsApp Web visit to the same identity over time.

  • Page address
    https://web.whatsapp.com/

    The full WhatsApp Web URL open when the beacon fires.

  • Page title and app version
    W: 2.3000.1046973889, WA-JS: 4.5.0

    The tab title, set by the library to include the WhatsApp Web and wa-js version numbers.

  • Login status
    authenticated=true

    Whether you are currently signed in to WhatsApp Web in this browser session.

  • Event name
    en=login

    Which action triggered the beacon: page view, login, logout, or ongoing engagement.

The code that does this

wa.js's Tracker class builds the persistent client ID and beacons it via sendBeacon

Readable version

Client ID creation and analytics header fields

wa.js
class Tracker {  static get clientState() {    const isFirstVisit = !localStorage.cid;    const clientId = localStorage.cid || sessionStorage.cid      || randomInt(1e9) + "." + Math.floor(Date.now() / 1000);    localStorage.cid = sessionStorage.cid = clientId;    return { firstVisit: isFirstVisit, cid: clientId };  }  constructor(trackingId) {    this.trackingId = trackingId;    this.events = [];    this.userProperties = {};    this.lastTime = Date.now();    this.hitsCount = 1;    this.documentTitle = "";  }  get sid() {    const key = `${this.trackingId}_sid`;    const value = sessionStorage[key] || Math.floor(Date.now() / 1000);    return sessionStorage[key] = value, value;  }  get sct() {    const key = `${this.trackingId}_sct`;    let count = parseInt(localStorage[key]);    if (isNaN(count)) count = 0;    return localStorage[key] = count + 1, localStorage[key];  }  getHeader() {    const { cid, firstVisit } = Tracker.clientState;    return {      v: 2,      tid: this.trackingId,        // Google Analytics measurement ID      cid,                         // the persistent client ID      _fv: firstVisit ? 1 : undefined,      ul: (navigator.language || "").toLowerCase() || undefined,      sr: `${screen.width}x${screen.height}`,      sid: this.sid,      sct: this.sct,      dl: location.href,           // full page URL      dr: document.referrer,      dt: this.documentTitle || document.title    };  }}

processEvents() serializes the header and events, then calls sendBeacon

wa.js
processEvents() {  const events = this.events;  if (this.events = [], !events.length) return;  const eventParams = events.map(([name, props, elapsed]) => {    const pairs = [["en", name], ["_ee", "1"]];    for (const key in props) {      pairs.push([`ep.${key}`, String(props[key])]);    }    pairs.push(["_et", String(elapsed)]);    return pairs;  });  const headerParams = Object.entries(this.getHeader())    .filter(([, v]) => v !== undefined)    .map(([k, v]) => [k, String(v)]);  const query = new URLSearchParams(headerParams);  // Beacon fires with no user interaction and no consent prompt.  navigator.sendBeacon(`${Tracker.collectURL}?${query}`);}

Tracker instantiated with Google's measurement ID unless config disables it

wa.js
Tracker.collectURL = "https://analytics.google.com/g/collect";// One Tracker per WhatsApp page load, hardcoded to this extension's// Google Analytics property, gated only by an internal config flag.const primaryTracker = new Tracker("G-MTQ4KY110F");
Where the beacon lands
    • analytics.google.com

    Google's Measurement Protocol endpoint. Receives the client ID, page URL, referrer, and title on every WhatsApp Web page load.

Where it sends data

Destinations our analysis observed WA Message Sending Bot contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    WA Message Sending Bot sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

Updated 30 September 2026dcmcongoliejhianllkdefemgiljjdjl