Is WA Quick Recruit by Job Hai safe?

Medium risk

WA Quick Recruit sends WhatsApp Web page telemetry to Google Analytics and message links to link-preview servers.

When it runs on WhatsApp Web, the extension injects the WA-JS library, which sends page URL, referrer, page title, browser language, screen size, and locally stored IDs to Google Analytics. When broadcast messages contain links, WA-JS uses its default link-preview behavior to send those URLs to third-party preview services before the messages are sent.

Info Edge India Ltdv1.14Chrome Web Store
49Risk
Who publishes it

M/S Info Edge India Limited - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Info Edge India Ltd
Declared legal entity
M/S Info Edge India Limited
Registered address
B-8, SECTOR-132, NOIDA,, Gautam Buddha Nagar, Uttar Pradesh 201304, IN
Registered contact
Roushan Bharti

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WA Quick Recruit sends WhatsApp Web page data to Google Analytics

Opening web.whatsapp.com with this extension installed loads a bundled automation library whose Google Analytics tracker ships enabled by default, sending your page URL, referrer, and a persistent visitor ID to Google on every visit.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open web.whatsapp.com with the extension installed.

No sign-in or additional action is needed to trigger it.

The extension did this

The extension injects a bundled automation library that sends a Google Analytics beacon describing the page.

The library's analytics toggle ships set to false (analytics enabled), so the beacon fires unless the setting is changed.

Captured request
POSThttps://analytics.google.com/g/collect?v=2&tid=G-MTQ4KY110F&cid=1065618084.1788903696&dl=https%3A%2F%2Fweb.whatsapp.com%2F&ul=en-us&sr=800x600
Body
en=user_engagement&_ee=1&_et=202
Parameters sent in the Google Analytics beacon
  • Visitor ID
    1065618084.1788903696

    A random ID stored in your browser and reused on every visit, letting Google tie your WhatsApp Web sessions together over time.

  • Page URL
    https://web.whatsapp.com/

    The full address of the page you were on when the beacon fired.

  • Referrer
    https://www.google.com/ (illustrative, not the captured value)

    The page you navigated from before landing on WhatsApp Web, if any.

  • Page title
    WhatsApp

    The browser tab title at the time the beacon fired.

  • Browser language
    en-us

    Your browser's configured display language.

  • Screen size
    800x600

    The width and height of your screen in pixels.

The code that does this

WA-JS ships analytics on by default

Readable version

Default config: disableGoogleAnalytics is false

scripts/wppconnect-wa.js
t.defaultConfig = {  deviceName: false,  liveLocationLimit: 10,  disableGoogleAnalytics: false,  googleAnalyticsId: null,  googleAnalyticsUserProperty: {},  linkPreviewApiServers: null,  poweredBy: "WA-JS",  sendStatusToDevice: false,  syncAllStatus: true}

The tracker is created with a hardcoded ID regardless of extension config

scripts/wppconnect-wa.js
waVersion = "4.3.0";const titleParts = ["W: ", "-", ", WA-JS: ", waVersion];const primaryTracker = new Tracker("G-MTQ4KY110F");const secondaryTracker = config.googleAnalyticsId  ? new Tracker(config.googleAnalyticsId)  : null;
Where the beacon goes
    • analytics.google.com

    Google's Measurement Protocol collection endpoint. Receives page URL, referrer, page title, browser language, screen size, and a persistent client ID from web.whatsapp.com visits.

Outgoing WhatsApp links sent to link-preview servers

Sending or broadcasting a WhatsApp link through WA Quick Recruit by Job Hai keeps link previews enabled by default.

The URL is sent to third-party link-preview endpoints, which can also process page content used to build the preview.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user sends or broadcasts a WhatsApp message containing a URL.

The extension did this

The extension sends the outgoing message link to third-party link-preview servers because link previews remain enabled by default.

Captured request
GETcobrancas.uppermesh.com.br:8000/v1/link-preview/fetch-data.png; wajsapi.titanchat.com.br/v1/link-preview/fetch-data.png; wppc-linkpreview.cloudtrix.com.br/v1/link-preview/fetch-data.png
Fields in the request
  • Outgoing message URL
    https://example.com/job-posting (illustrative)

    The link typed into the WhatsApp message is enough to reveal the destination being shared or discussed.

  • Preview page content
    Example Job Posting - Apply Today (illustrative)

    Content retrieved for the link preview can expose page title, description, or image data associated with the shared link.

Where it sends data

Destinations our analysis observed WA Quick Recruit by Job Hai contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • analytics.google.comwidely used

    WA Quick Recruit by Job Hai sends data to analytics.google.com. A widely used service: 25 other extensions we have analysed send data here.

  • wajsapi.titanchat.com.br

    WA Quick Recruit by Job Hai sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    WA Quick Recruit by Job Hai sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • cobrancas.uppermesh.com.br

    WA Quick Recruit by Job Hai sends data to cobrancas.uppermesh.com.br. 8 other extensions we have analysed send data here.

Updated 30 September 2026ieacglkkmemcenknbponnlnfgbolmoca