Is WA - Send Message without saving contact safe?

High risk

WA - Send Message without saving contact writes WhatsApp message details and the active tab URL to Firebase.

When it opens or sends WhatsApp messages, the extension reads the recipient number, message text, sender contact, UID, event source, and active URL. It writes those values to Firestore documents in the Firebase project getstormyapp, including telemetry and user message records.

Dictation Daddy Technologiesv1.67Chrome Web Store
72Risk
Who publishes it

Dictation Daddy Technologies - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Dictation Daddy Technologies

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

Speech to Text & Dictation - DictationDaddy1k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp message details written to Firebase

When you send or open a WhatsApp message via WA - Send Message without saving contact, the extension writes a Firestore record to Firebase project getstormyapp: phone number, message text, contact, UID, source, timestamp, page URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You use the extension to send or open a WhatsApp message.

The popup, context menu, Facebook icon, and auto-send paths all route message data into the service worker.

The extension did this

The extension writes a Firebase record containing the recipient, message text, sender contact, UID, event source, and active URL.

Behavioral verification observed Firestore traffic for Firebase project getstormyapp, and the shipped code shows the exact fields written.

Fields written by the service worker
  • Message text
    Hi, are you available today? (illustrative)

    This is the WhatsApp message body you ask the extension to send.

  • Recipient phone number
    +14155550123 (illustrative)

    This identifies who you are contacting through WhatsApp.

  • Saved sender contact
    14155550987 (illustrative)

    This can connect multiple send events back to the same WhatsApp account or browser profile.

  • Extension UID
    A7kP9xLmQ2 (illustrative)

    This lets repeated events from the same installed extension profile be grouped together.

  • Event source
    POPUP (illustrative)

    This describes which extension feature triggered the send flow.

  • Active page URL
    https://web.whatsapp.com/ (illustrative)

    This adds browsing context to the message event, such as the page that was active when the extension acted.

Captured request
POSThttps://firestore.googleapis.com/google.firestore.v1.Firestore/Write/channel?database=projects/getstormyapp/databases/(default)

Firestore write stream for Firebase project getstormyapp.

The code that does this

The shipped code that saves the WhatsApp contact and writes Firestore records

Readable version

Readable equivalent of the WhatsApp contact capture

assets/detect.57ac1cdc.js
const rawWid = window.localStorage.getItem("last-wid-md");const parseContact = (value) => value ? value.split(":")[0].trim() : "";const params = Object.fromEntries(new URLSearchParams(window.location.search).entries());const installedFlow = Object.prototype.hasOwnProperty.call(params, "status") && params.status === "installed";if (installedFlow) {  chrome.runtime.sendMessage({ action: "installed", userContact: parseContact(rawWid) });}chrome.storage.sync.set({ userContact: parseContact(rawWid) });chrome.runtime.sendMessage({ action: "updateUninstallUrl" });

Readable equivalent of the Firebase setup

assets/background.ts.3d7f49cc.js
const firebaseConfig = {  apiKey: "AIzaSyCu7T1zIxH8Dn8I44hPJWEIY_eMMDqdWjY",  authDomain: "getstormyapp.firebaseapp.com",  projectId: "getstormyapp",  storageBucket: "getstormyapp.appspot.com",  messagingSenderId: "309351253553",  appId: "1:309351253553:web:41c53322bf44dd461e7710",  measurementId: "G-10V351TG35"};const firebaseApp = initializeApp(firebaseConfig);const firestore = getFirestore(firebaseApp);

Readable equivalent of Im and Ol

assets/background.ts.3d7f49cc.js
const openOrSendMessage = (phoneNumber, messageText, source) => {  try {    chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {      writeMessageTelemetry(phoneNumber, messageText, source, tabs[0]?.url || "none");    });  } catch (error) {    console.log("Failed to send Telemetry", error);  }  try {    chrome.tabs.query({ url: "https://web.whatsapp.com/*" }, (tabs) => {      for (const tab of tabs) {        if (tab && tab.favIconUrl && !tab.favIconUrl.includes("error")) {          focusTab(tab);          chrome.tabs.sendMessage(tab.id, {            data: { message: messageText, phoneNumbers: [phoneNumber] },            type: SEND_MESSAGES_ON_WHATSAPP_WEB          });          return;        }      }      chrome.tabs.create({ url: "https://api.whatsapp.com/send/?phone=" + phoneNumber + "&text=" + encodeURI(messageText) });    });  } catch {}};const writeMessageTelemetry = (phoneNumber, messageText, eventSource, activeUrl) => {  chrome.storage.sync.get(["userContact", "uid", "email", "id"], async (stored) => {    setUninstallUrl(stored.userContact, stored.email, stored.id, stored.uid);    const telemetryDocumentId = (new Date("12-12-2222").getTime() - new Date().getTime()).toString();    const telemetryDocument = doc(firestore, "telemetry2.0", telemetryDocumentId);    setDoc(telemetryDocument, {      phoneNumber,      text: messageText,      userContact: stored.userContact || "unknown",      time: new Date(),      event: eventSource,      uid: stored.uid || "unknown",      activeUrl    });    const userDocument = doc(firestore, "users", stored.userContact || stored.uid);    setDoc(userDocument, {      userContact: stored.userContact,      uid: stored.uid,      messages: arrayUnion({        no: phoneNumber,        txt: messageText,        ul: activeUrl,        et: eventSource,        t: new Date()      })    }, { merge: true });  });};

Readable equivalent of the SEND_MESSAGES and Da path

assets/background.ts.3d7f49cc.js
chrome.runtime.onMessage.addListener((message) => {  if (message.type === "SEND_MESSAGES") {    const { source, countryCode, numbers, message: messageText, enableSmartCode } = message.data;    sendMessages(countryCode, numbers, messageText, enableSmartCode, source);  }});const sendMessages = (countryCode, numbers, messageText, enableSmartCode, source) => {  const parsedNumbers = [];  for (const number of numbers) {    parsedNumbers.push(parsePhoneNumber(number, countryCode, enableSmartCode));  }  chrome.tabs.query({ active: true, url: "https://web.whatsapp.com/*" }, (tabs) => {    if (tabs.length === 0) {      openOrSendMessage(parsedNumbers[0], messageText || "", source);      return;    }    getMessageLimit(parsedNumbers.length).then(({ count, isPremium }) => {      if (count <= dailyLimit || isPremium) {        chrome.tabs.sendMessage(tabs[0].id, {          type: SEND_MESSAGES_ON_WHATSAPP_WEB,          data: { phoneNumbers: parsedNumbers, message: messageText, source }        });        writeMessageTelemetry(parsedNumbers, messageText, source, "https://web.whatsapp.com");      } else {        chrome.tabs.create({ url: "https://orso.app/pricing" });      }    }).catch((error) => {      chrome.tabs.create({ url: "https://orso.app/pricing" });      console.log("You have reached your message limit", error);    });  });};
External services receiving or related to the send flow
    • firestore.googleapis.com

    Google Firestore endpoint used by Firebase project getstormyapp to receive telemetry2.0 and users document writes.

    • getstormyapp.firebaseapp.com

    Firebase application hostname configured in the bundled Firebase project settings.

    • api.whatsapp.com

    WhatsApp send URL opened by the extension when no active WhatsApp Web tab is available.

    • us-central1-getstormyapp.cloudfunctions.net

    Cloud Functions host used by the extension's uninstall URL path with stored contact and UID parameters.

What it can do

Permissions this extension asks for, as declared in version 1.67. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed WA - Send Message without saving contact contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • firestore.googleapis.com

    WA - Send Message without saving contact sends data to firestore.googleapis.com. 16 other extensions we have analysed send data here.

Updated 30 September 2026ofemdidpfidcildnbofhobedhabifaec