Is WA Quick Group - Import WA Group members CSV safe?

Medium risk

WA Quick Group sends generated WhatsApp group invite links to third-party link-preview services during invite messages.

When a user uses the extension on WhatsApp Web to create a group or invite members, it sends messages containing chat.whatsapp.com invite links. The link-preview code then requests preview metadata from one of three external preview endpoints, placing the invite URL in the request's url parameter.

WA Awesome Toolv1.1.0Chrome Web Store
45Risk
Who publishes it

WA Awesome Tool - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
WA Awesome Tool

Same store account

1 other listing published from this account, 2k+ users between them, none of them carrying a finding.

WA Group Sender & Group Link Scraper2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp group invite links go to third-party preview services

Bulk-inviting members generates a WhatsApp group invite link sent in WhatsApp Web messages.

WhatsApp's link-preview handling then requests preview metadata from a third party, sending the invite URL outside WhatsApp.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You start the extension's bulk group invite workflow on WhatsApp Web.

The extension did this

The extension generates a WhatsApp group invite link and sends message text that can trigger third-party link-preview requests.

Captured request
POSTlinkpreview.ddns.info/v1/link-preview/fetch-data.png
Fields in the request
  • WhatsApp group invite URL
    https://chat.whatsapp.com/AbCdEfGhIjKlMnOp (illustrative)

    The invite URL can allow access to the WhatsApp group invite flow and identifies the group invite being shared.

Observation

Dynamic analysis confirmed that the extension is scoped to WhatsApp Web, builds a chat.whatsapp.com invite, and relies on link-preview code that requests preview data from third-party preview servers.

What it can do

Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed WA Quick Group - Import WA Group members CSV contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wajsapi.titanchat.com.br

    WA Quick Group - Import WA Group members CSV sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    WA Quick Group - Import WA Group members CSV sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • linkpreview.ddns.info

    WA Quick Group - Import WA Group members CSV sends data to linkpreview.ddns.info. No other extension we have analysed sends data here.

Updated 30 September 2026nimhpogohihnabaooccdllippcaaloie