Is Transcribe WhatsApp Audio with AI - Convert Audio to Text safe?

Medium risk

Transcribe WhatsApp Audio with AI - Convert Audio to Text is medium risk. Every time you open WhatsApp Web with this extension installed, it reads your phone number and business-account status from the page and sends both to the developer's own server, before you record or transcribe anything.

Cleverson Pelegriniv2.7.14Chrome Web Store

45Risk

Who publishes it

Cleverson Pelegrini - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Cleverson Pelegrini

Same store account

2 other listings published from this account, 4k+ users between them, none of them carrying a finding.

WA Scheduler and Bulk Send3k+Low Bulk Contact Saver for WhatsApp1k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp Transcriber Sends Your Phone Number To Its Server On Every Visit

Every time you open WhatsApp Web with this extension installed, it reads your phone number and business-account status from the page and sends both to the developer's own server, before you record or transcribe anything.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You open WhatsApp Web with the extension installed.

No recording or transcription action is needed to trigger this.

The extension did this

The extension reads your WhatsApp phone number and sends it to its own server.

A flag showing whether your account is a WhatsApp Business account is sent alongside it.

Sent to the developer's /auth endpoint on every WhatsApp Web load

Your WhatsApp phone number
15551234567
The phone number tied to your WhatsApp account, sent in plain text as a request header.
Business account flag
false
Whether your WhatsApp account is a business account, read from WhatsApp's own page state.

Captured request

GEThttps://transcriber-back.cleversonpelegrini.workers.dev/auth

200 OK, JSON body containing a session token used to gate the transcription feature

Headers

x-phone: 15551234567
x-business: false

The code that does this

The extension ships readable, unminified source; this is the code as distributed

Readable version

Show shipped source

content.js: reads phone number and account type, relays to the background worker

content.js

const interval = setInterval(() => {	if (!document.getElementById("side")) return;	if (!document.body.hasAttribute("data-is-business")) return;	clearInterval(interval);		phone = localStorage.getItem("last-wid-md")?.match(/"(\d+):/)[1];	isBusiness = document.body.getAttribute("data-is-business") === "true";	chrome.runtime.sendMessage({ type: "CHECK_SUBSCRIPTION", phone, isBusiness });

service_worker.js: sends the phone number and flag to the developer's backend

service_worker.js

const BACKEND_URL = "https://transcriber-back.cleversonpelegrini.workers.dev";chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {	if (request.type === "CHECK_SUBSCRIPTION") {		checkSubscription(request.phone, request.isBusiness, sender.tab.id);	}	...});async function checkSubscription(phone, isBusiness, tabId, attempts = 0) {	...	const r = await fetch(`${BACKEND_URL}/auth`, {		headers: { 			"x-phone": phone,			"x-business": String(isBusiness)		}	});	...}

Where your phone number ends up

- transcriber-back.cleversonpelegrini.workers.dev
Cloudflare Workers backend run by the extension developer. Receives your phone number and business flag on every page load, and separately handles audio uploads for transcription.