Is WAPP Group Link Generator safe?

Medium risk

WAPP Group Link Generator sends your signed-in Chrome profile email to app.soletstalkapp.com each time the popup opens.

When the popup loads, the extension reads the Chrome profile email through the identity permission and includes it in a request URL to a licence-check server. The response decides whether a subscribe prompt is shown. No consent step precedes the request.

So Lets Talk Digitalv1.0.0Chrome Web Store
49Risk
Who publishes it

So Lets Talk Digital - 13 other listings from the same operator, 3 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
So Lets Talk Digital
Declared legal entity
So Lets Talk Digital
Website
soletstalkapp.com/contact

Same store account

13 other listings published from this account, 2k+ users between them. 3 of them carry a finding.

So Lets Talk Digital - WA Sender810LowSLTD - Business Tools Sender273MediumWAPP Group Sender88LowJustdial Lead Generator80CleanLinkedIn Video Downloader75MediumWA Plus Bulk Sender75Clean7 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup sends your Chrome profile email to a licence server on every open

Code analysis shows the popup reads the signed-in Chrome profile email and sends it in a URL query to app.soletstalkapp.com each time it opens, to check a subscription status.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open the extension popup.

The extension did this

It sends your Chrome profile email to app.soletstalkapp.com.

The email is placed in the URL query string.

Values in the request
  • Profile email
    jane.doe@example.com

    Ties the request to the person signed in to Chrome.

  • Product id
    3

    Tells the server which product is asking.

The code that does this

Profile email read and sent in the URL

Readable version

popup.js is unminified, so the shipped source is the readable form

popup.js
chrome.identity.getProfileUserInfo((userInfo) => {  fetch(`https://app.soletstalkapp.com/stats/ispro?email=${userInfo.email}&id=3`)    .then((r) => r.json())    .then(showOrHideSubscribePanel);});
Where the email goes
    • app.soletstalkapp.com

    Receives the profile email and product id in a GET query to return a subscription flag.

Check if you're affected

Searches a proxy or DNS log export for the licence lookup request.

Requires
  • POSIX shell
  • grep
find_ispro_requests.sh · sh
#!/bin/sh# Usage: ./find_ispro_requests.sh proxy_log.txtgrep -E 'app\.soletstalkapp\.com/stats/ispro\?email=' "$1"
How to run it
  1. 1Export proxy logs as text.
  2. 2Run the script against the file.
  3. 3Each match is one popup open by a user.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed WAPP Group Link Generator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.soletstalkapp.com

    WAPP Group Link Generator sends data to app.soletstalkapp.com. 5 other extensions we have analysed send data here.

Updated 15 October 2026fjbpmndkeboplpbppggkplldmfemhfdc