Is WA Web Sender - Free Bulk Message Sender safe?

Medium risk

WA Web Sender sends the user's WhatsApp phone number and location context to Google Analytics.

WA Web Sender reads or derives the user's WhatsApp phone number and combines it with plan, version, event, and GeoJS-derived location fields for Google Analytics events. If the user answers the post-campaign design feedback prompt, it also posts the WhatsApp number with the feedback response and timestamp to SheetDB.

Productivity Extensionsv4.5.8Chrome Web Store
49Risk
Who publishes it

Productivity Extensions - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Productivity Extensions

Same store account

1 other listing published from this account, 5k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WA Web Sender sends your linked WhatsApp number to Google Analytics

We observed the extension send your WhatsApp phone number to Google Analytics every time WhatsApp Web loads with a linked number, tied to a per-install analytics ID it also creates.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open web.whatsapp.com with a phone number already linked in this browser, or confirm one in the extension's own popup.

No separate consent prompt is shown for this specific event.

The extension did this

The extension reads your linked WhatsApp number and sends it to Google Analytics as an event parameter.

The same number is sent again from the extension popup when it re-reads the stored number.

What the Google Analytics event carries
  • Your WhatsApp number
    919876543210 (illustrative)

    Ties every analytics event to your specific WhatsApp account instead of an anonymous install.

  • Analytics install ID
    550e8400-e29b-41d4-a716-446655440000

    A random ID the extension generates once and stores locally so Google Analytics can group your events over time.

  • App and store version
    init_store_type: legacy, extension_version: 4.5.8

    Tells the vendor which WhatsApp store type and extension version you are running.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-RKJ49K5JXL&api_secret=<redacted>

204 No Content (Measurement Protocol does not echo the event back)

Body
{  "client_id": "550e8400-e29b-41d4-a716-446655440000",  "events": [    {      "name": "pro_my_number",      "params": {        "track": "919876543210",        "session_id": "1725798132251",        "engagement_time_msec": 100      }    }  ]}
The code that does this

How the number reaches the analytics call

Readable version

reload_my_number() -- reads your number from storage, then WhatsApp's own session keys

js/content.js
async function reload_my_number() {    // First check the extension's own saved copy of your number    let result = await chrome.storage.local.get('my_number');    my_number = result.my_number || null;    if (!my_number) {        // Fall back to WhatsApp Web's own logged-in session identifiers        var last_wid = window.localStorage.getItem("last-wid");        var last_wid_md = window.localStorage.getItem("last-wid-md");        if (last_wid_md)            my_number = window.localStorage.getItem("last-wid-md").split("@")[0].substring(1).split(":")[0];        else if (last_wid)            my_number = window.localStorage.getItem("last-wid").split("@")[0].substring(1);        if (my_number)            chrome.storage.local.set({ my_number: my_number }); // cache it for next time    }    if (!my_number) {        trackSystemEvent('no_number', 'track');    } else {        // Number found: fire an analytics event carrying it        trackSystemEvent('my_number', my_number);    }}

fireEvent() -- packages the event and POSTs it to Google Analytics

js/Utils/ga-code.js
async fireEvent(name, params = {}) {    // Attach a session id and a default engagement time, GA requires both    if (!params.session_id) {        params.session_id = await this.getOrCreateSessionId();    }    if (!params.engagement_time_msec) {        params.engagement_time_msec = GA_CONFIG.DEFAULT_ENGAGEMENT_TIME_MSEC;    }    // POST straight to Google's Measurement Protocol collector, using a    // hardcoded measurement ID and API secret shipped in the extension    const response = await fetch(        `${GA_CONFIG.GA_ENDPOINT}?measurement_id=${GA_CONFIG.MEASUREMENT_ID}&api_secret=${GA_CONFIG.API_SECRET}`,        {            method: 'POST',            body: JSON.stringify({                client_id: await this.getOrCreateClientId(),                events: [ { name, params } ] // params.track carries your number            })        }    );}
Where the data ends up
    • www.google-analytics.com

    Google's Measurement Protocol collector. Receives your WhatsApp number and usage events under a measurement ID the extension vendor controls.

What we did and did not confirm

The code also derives your city, region, and country from your IP address on install and can attach them to these events, but no captured event included those fields in this test session.

Feedback prompt sends WhatsApp phone number to SheetDB

When you respond to the post-campaign design feedback prompt, the extension sends your WhatsApp phone number to a SheetDB endpoint.

The request includes the stored contact number along with the Yes or No feedback response and a timestamp.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You click Yes or No in the design feedback prompt after completing a campaign.

The extension did this

The extension posts the stored WhatsApp phone number with the feedback response and timestamp.

Captured request
POSThttps://sheetdb.io/api/v1/wbzt6s0lud7bg
Fields in the request
  • Stored WhatsApp phone number
    +15551234567 (illustrative)

    This contact number can identify the WhatsApp account tied to the feedback response.

Where it sends data

Destinations our analysis observed WA Web Sender - Free Bulk Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    WA Web Sender - Free Bulk Message Sender sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • get.geojs.io

    WA Web Sender - Free Bulk Message Sender sends data to get.geojs.io. 4 other extensions we have analysed send data here.

  • sheetdb.io

    WA Web Sender - Free Bulk Message Sender sends data to sheetdb.io. 2 other extensions we have analysed send data here.

Updated 30 September 2026cmibkdkcjkhjinfeobpnfgpafbjdgbke