Is WAPPMASTER Contacts Extractor safe?

Medium risk

WAPPMASTER Contacts Extractor sends the WhatsApp account number it reads from web.whatsapp.com storage to Aptabase.

When the popup opens or contacts are extracted, the extension asks its content script for the WhatsApp account number stored by web.whatsapp.com. It includes that number as an analytics event property and sends the event to Aptabase.

Rao Information Technologyv2.3.9Chrome Web Store
45Risk
Who publishes it

Rao Information Technology - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Rao Information Technology
Website
wappmaster.app/contact-us/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup analytics sends WhatsApp account number to Aptabase

Opening the WAPPMASTER popup or extracting contacts reads your WhatsApp account number from web.whatsapp.com storage and includes it in Aptabase analytics events, sent via POST to us.aptabase.com/api/v0/event as event properties.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the popup or starts contact extraction.

The extension did this

The extension reads the WhatsApp account number from web.whatsapp.com storage and adds it to Aptabase analytics events.

Captured request
POSThttps://us.aptabase.com/api/v0/event
Fields in the request
  • WhatsApp account number from storage
    15551234567 (illustrative)

    This value identifies the WhatsApp account associated with the browser session.

Observation

Observed during dynamic analysis: the popup requests the WhatsApp number from the content script, which reads localStorage['last-wid-md'], and the background script initializes Aptabase for the same event endpoint.

What it can do

Permissions this extension asks for, as declared in version 2.3.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed WAPPMASTER Contacts Extractor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • us.aptabase.com

    WAPPMASTER Contacts Extractor sends data to us.aptabase.com. No other extension we have analysed sends data here.

Updated 30 September 2026moeihekkmkijlgmmablmbkjeojmkaagh