Is WA Web Sender - Free Bulk Message Sender safe?
WA Web Sender sends the user's WhatsApp phone number and location context to Google Analytics.
WA Web Sender reads or derives the user's WhatsApp phone number and combines it with plan, version, event, and GeoJS-derived location fields for Google Analytics events. If the user answers the post-campaign design feedback prompt, it also posts the WhatsApp number with the feedback response and timestamp to SheetDB.
Who publishes itProductivity Extensions - 1 other listing from the same operator, none carrying a finding
Productivity Extensions - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 5k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WA Web Sender sends your linked WhatsApp number to Google Analytics
We observed the extension send your WhatsApp phone number to Google Analytics every time WhatsApp Web loads with a linked number, tied to a per-install analytics ID it also creates.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open web.whatsapp.com with a phone number already linked in this browser, or confirm one in the extension's own popup.
No separate consent prompt is shown for this specific event.
The extension reads your linked WhatsApp number and sends it to Google Analytics as an event parameter.
The same number is sent again from the extension popup when it re-reads the stored number.
- Your WhatsApp number919876543210 (illustrative)
Ties every analytics event to your specific WhatsApp account instead of an anonymous install.
- Analytics install ID550e8400-e29b-41d4-a716-446655440000
A random ID the extension generates once and stores locally so Google Analytics can group your events over time.
- App and store versioninit_store_type: legacy, extension_version: 4.5.8
Tells the vendor which WhatsApp store type and extension version you are running.
204 No Content (Measurement Protocol does not echo the event back)
{ "client_id": "550e8400-e29b-41d4-a716-446655440000", "events": [ { "name": "pro_my_number", "params": { "track": "919876543210", "session_id": "1725798132251", "engagement_time_msec": 100 } } ]}How the number reaches the analytics call
reload_my_number() -- reads your number from storage, then WhatsApp's own session keys
js/content.jsasync function reload_my_number() { // First check the extension's own saved copy of your number let result = await chrome.storage.local.get('my_number'); my_number = result.my_number || null; if (!my_number) { // Fall back to WhatsApp Web's own logged-in session identifiers var last_wid = window.localStorage.getItem("last-wid"); var last_wid_md = window.localStorage.getItem("last-wid-md"); if (last_wid_md) my_number = window.localStorage.getItem("last-wid-md").split("@")[0].substring(1).split(":")[0]; else if (last_wid) my_number = window.localStorage.getItem("last-wid").split("@")[0].substring(1); if (my_number) chrome.storage.local.set({ my_number: my_number }); // cache it for next time } if (!my_number) { trackSystemEvent('no_number', 'track'); } else { // Number found: fire an analytics event carrying it trackSystemEvent('my_number', my_number); }}fireEvent() -- packages the event and POSTs it to Google Analytics
js/Utils/ga-code.jsasync fireEvent(name, params = {}) { // Attach a session id and a default engagement time, GA requires both if (!params.session_id) { params.session_id = await this.getOrCreateSessionId(); } if (!params.engagement_time_msec) { params.engagement_time_msec = GA_CONFIG.DEFAULT_ENGAGEMENT_TIME_MSEC; } // POST straight to Google's Measurement Protocol collector, using a // hardcoded measurement ID and API secret shipped in the extension const response = await fetch( `${GA_CONFIG.GA_ENDPOINT}?measurement_id=${GA_CONFIG.MEASUREMENT_ID}&api_secret=${GA_CONFIG.API_SECRET}`, { method: 'POST', body: JSON.stringify({ client_id: await this.getOrCreateClientId(), events: [ { name, params } ] // params.track carries your number }) } );}- www.google-analytics.com
Google's Measurement Protocol collector. Receives your WhatsApp number and usage events under a measurement ID the extension vendor controls.
The code also derives your city, region, and country from your IP address on install and can attach them to these events, but no captured event included those fields in this test session.
Feedback prompt sends WhatsApp phone number to SheetDB
When you respond to the post-campaign design feedback prompt, the extension sends your WhatsApp phone number to a SheetDB endpoint.
The request includes the stored contact number along with the Yes or No feedback response and a timestamp.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You click Yes or No in the design feedback prompt after completing a campaign.
The extension posts the stored WhatsApp phone number with the feedback response and timestamp.
- Stored WhatsApp phone number+15551234567 (illustrative)
This contact number can identify the WhatsApp account tied to the feedback response.
Where it sends data
Destinations our analysis observed WA Web Sender - Free Bulk Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
WA Web Sender - Free Bulk Message Sender sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- get.geojs.io
WA Web Sender - Free Bulk Message Sender sends data to get.geojs.io. 4 other extensions we have analysed send data here.
- sheetdb.io
WA Web Sender - Free Bulk Message Sender sends data to sheetdb.io. 2 other extensions we have analysed send data here.