Is WA Bulk Message Sender - WAMessager safe?

High risk

WAMessager is high risk. Opening the WAMessager popup on WhatsApp Web makes the extension read your Chrome profile email and ask the content script for the active account number, then POST both as JSON to wamessager-backend.onrender.com/api/user/createUser.…

wamessagerv8.0.1Chrome Web Store
75Risk
Who publishes it

wamessager - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
wamessager

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

media-bom2-2.cdn.whatsapp.net
Also called by 1 other listing: WA-CRM: Best WA CRM for Business Development and Sales Teams
wa-crm.com
Also called by 1 other listing: WA-CRM: Best WA CRM for Business Development and Sales Teams

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Google email and WhatsApp number sent on popup open

Opening the WAMessager popup on WhatsApp Web makes the extension read your Chrome profile email and ask the content script for the active account number, then POST both as JSON to wamessager-backend.onrender.com/api/user/createUser.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup while WhatsApp Web is the active site.

The popup initialization runs after it finds or opens a WhatsApp Web tab.

The extension did this

The extension combines your Chrome profile email with your WhatsApp account number and prepares a backend request.

The code path is in the popup startup handler and the WhatsApp content-script message receiver.

Fields placed into the user-creation request by popup.js
  • Chrome profile email
    alex.morgan@gmail.com (illustrative)

    Links the request to the Google account signed into the browser profile.

  • WhatsApp account number
    +14155552671 (illustrative)

    Links the same request to the WhatsApp account open in the tab.

Captured request
POSThttps://wamessager-backend.onrender.com/api/user/createUser
Headers
Content-Type
application/json
The code that does this

Complete shipped functions behind the popup-to-backend flow

Readable version

Readable flow equivalent

js/popup.js and content.js
async function initializePopup() {  const [activeTab] = await chrome.tabs.query({ active: true, currentWindow: true });  chrome.tabs.sendMessage(activeTab.id, { greeting: "hello" }, async (reply) => {    if (!reply || reply.number == null) return;    const phoneNumber = reply.number;    chrome.identity.getProfileUserInfo(async (profile) => {      if (!profile || !profile.id) return;      const email = profile.email;      await createUser(email, phoneNumber);    });  });}async function createUser(email, phoneNumber) {  const headers = new Headers();  headers.append("Content-Type", "application/json");  const body = JSON.stringify({ email, phoneNumber });  return fetch("https://wamessager-backend.onrender.com/api/user/createUser", {    method: "POST",    headers,    body,    redirect: "follow"  });}function getWhatsAppNumberFromPageStorage() {  if (window.localStorage.getItem("last-wid")) {    return window.localStorage.getItem("last-wid").split("@")[0].substring(1);  }  return window.localStorage.getItem("last-wid-md").split(":")[0].substring(1);}
Backend involved in this claim
    • wamessager-backend.onrender.com

    Receives the createUser POST containing the Chrome profile email and WhatsApp account number; hosted on Render.

WhatsApp phone number reported after bulk sends

After a bulk WhatsApp send session, WAMessager reads the WhatsApp account identifier from the page's local storage, counts messages sent, and posts that phone number plus the send count to wamessager-backend.onrender.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You complete a bulk WhatsApp send session through the extension.

The code path only reaches the backend update when the send loop records at least one sent message.

The extension did this

The extension sends your WhatsApp phone number and the session's sent-message count to its backend.

The phone number is derived from WhatsApp local storage before the send session runs.

Fields prepared for the backend update
  • Your WhatsApp phone number
    15551234567 (illustrative)

    Identifies the WhatsApp account used for the bulk send session.

  • Messages sent in the session
    42 (illustrative)

    Shows how many messages the extension recorded as sent during that run.

Captured request
POSThttps://wamessager-backend.onrender.com/api/user/updateUsedMessages
Headers
Content-Type
application/json
The code that does this

The storage read and post-send backend update in shipped code

Readable version

Readable page-load identifier extraction

content.js
window.onload = function () {  try {    if (window.localStorage.getItem("last-wid")) {      var a = window.localStorage.getItem("last-wid");      myNumber = a.split("@")[0].substring(1);    } else      ((a = window.localStorage.getItem("last-wid-md")),        (myNumber = a.split(":")[0].substring(1)));    chrome.storage.local.set({ currentState });  } catch (b) {}};

Readable send loop and backend update

content.js
async function core_sending(a, b, c, e, d, q, m, p, h, k, l) {  let g = 0;  currentState = (await chrome.storage.local.get("currentState")).currentState;  for (let f = 0; f < a.length; f++) {    a[f] = a[f].toString().replace(/\D/g, "").replace(/^0+/, "");    currentState = { ...currentState, msgCount: f, msgSent: g, msgTotal: m };    await chrome.storage.local.set({ currentState }, () => {      chrome.runtime.sendMessage({        subject: "progress-bar-sent",        from: "content",        count: f,        sent: g,        total: m,      });    });    pauseSending &&      ((currentState = { ...currentState, state: "PAUSE" }),      await chrome.storage.local.set({ currentState }),      await pauser());    if (stopSending) {      stopSending = !1;      break;    }    if (a[f] != "") {      var n = null;      f != 0 &&        ((n = parseInt(d) + Math.floor(Math.random() * (q - d))),        await sleep(n * 1e3));      l && f != 0 && f % parseInt(h) == 0        ? await sleep(parseInt(k) * 1e3)        : f != 0 && f % 10 == 0 && (await sleep(1e4));      n = !1;      try {        a[f].length > 4 && a[f].length < 21 && (n = await openChat(a[f]));      } catch (v) {        n = !1;      }      if (n) {        var t = isUnsubscribed();        if (t) rows.push([a[f], "User has unsubscribed"]);        else {          b[f] = b[f].trim();          if (            n &&            !t &&            b[f] != "" &&            (document.querySelectorAll("[contenteditable='true']")[1] ||              document.querySelectorAll("[contenteditable='true']")[0])          )            try {              (p && (b[f] += "\n\nSent at: " + new Date().toISOString()),                await sendText(b[f], a[f], 0),                rows.push([a[f], "Message sent"]),                g++);            } catch (v) {              console.log("error while sending to: ", a[f], v);              rows.push([a[f], "Some Error Please Try This Number Again"]);              continue;            }          if (e) {            // let v;            try {              let r = await chrome.storage.local.get("attachment_data");              // v = (await WAM.chat.getActiveChat()).id.user;              if ((r = r?.attachment_data))                for (let w = 0; w < r.length; w++) {                  await sleep(1e3);                  if (c) {                    let u = r[w].fileCaption;                    for (const [B, z] of Object.entries(c[0]))                      u = u.replaceAll("{{" + z + "}}", "{{" + B + "}}");                    var x = u.match(coloumn_pattern),                      A = u.match(replace_pattern);                    n = u;                    if (x != null && A != null)                      for (t = 0; t < x.length; t++)                        n = n.replace(A[t], c[f + 1][x[t]] || "");                    r[w].fileCaption = n;                  }                  await new Promise((u) => {                    window.addEventListener(                      "wam:attachments-sent",                      function C(z) {                        removeEventListener("wam:attachments-sent", C);                        u();                      },                    );                    window.postMessage({                      type: "FROM_CONTENT_SCRIPT",                      message: {                        request: "sendAttachment",                        attachment: r[w],                        // number: v,                      },                    });                  });                }              let y = rows[rows.length - 1];              y && y[0] == a[f]                ? (rows[rows.length - 1][1] = y[1] + " & Media Sent")                : rows.push([a[f], "Media sent"]);            } catch (r) {              console.log("ERROR in sending media to: ", a[f], r);            }          }        }      } else rows.push([a[f], "Invalid number"]);    }  }  currentState = { ...currentState, state: "STOP" };  await chrome.storage.local.set({ currentState }, () => {    chrome.runtime.sendMessage({      subject: "progress-bar-sent",      from: "content",      count: m,      sent: g,      total: m,    });    export_results();  });  g > 0 &&    ((a = {      method: "POST",      headers: { "Content-Type": "application/json" },      body: JSON.stringify({ phoneNumber: myNumber, messagesSent: g }),    }),    fetch(`${url}/api/user/updateUsedMessages`, a).then().catch(),    (a = (await chrome.storage.local.get("DAILY_MSG_LEFT")).DAILY_MSG_LEFT),    chrome.storage.local.set({ DAILY_MSG_LEFT: a - g }));}
Backend destination named in the code
    • wamessager-backend.onrender.com

    Receives the post-send update containing the WhatsApp phone number and the messages-sent count.

Updated 30 September 2026afgbckekjlfkfhklldgdndiagddhbohm