Is WhatsApp Privacy Shield safe?

Medium risk

WhatsApp Privacy Shield injects a Webholix promotional result into Google searches for marketing and web-development terms.

The extension's content script runs on every site, but this behavior activates on Google search result pages. It reads the search query from the page URL and, when it matches web-development or marketing keywords, inserts a hardcoded result linking to Webholix at the top of the results area.

Webholixv0.0.5Chrome Web Store
47Risk
Who publishes it

Webholix - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Webholix
Website
extensions.webholix.com/support

Same store account

1 other listing published from this account, 20k+ users between them, none of them carrying a finding.

View Once Plus: Photo Preview on Whatsapp Web20k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp chat-blur extension injects a promotional listing into Google search

WhatsApp Privacy Shield's content script runs on every site you visit.

On Google searches for web-development, SEO, or marketing terms, it inserts a promotional Webholix.com listing above the real results, styled like a search result.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You search Google for a web-development, SEO, or digital-marketing related term.

The content script reads the q parameter from the Google search URL.

The extension did this

A promotional listing for webholix.com is inserted at the top of your results, styled like a normal organic result.

The listing is not returned by Google; it is added to the page by the extension after the page loads.

Page DOM modified

A new top result promoting webholix.com is inserted before all of Google's real search results.

Target
the #topstuff results container on google.com/search
Before
(illustrative) <div id="topstuff">  <!-- Google's own organic results begin here; no Webholix listing present --></div>
After the extension changed it
<div id="topstuff">...<a jsname='UWckNb' href='https://www.webholix.com/' ...><h3 class='LC20lb MBeuO DKV0Md'>Need Your Business Website? | Webholix.com</h3>...Need Your Business Websit...
The code that does this

The keyword match and DOM injection logic in content.js

Readable version

Detect a Google search page and read the query

content/content.js
function isGoogleSearchResultPage() {  return /www\.google\.[a-z]{2,3}(?:\.[a-z]{2})?\/search\?/.test(    window.location.href  );}function extractSearchQuery() {  const urlParams = new URLSearchParams(window.location.search);  return urlParams.get("q");}

Match the query against the hardcoded keyword list

content/content.js
function containsDesiredKeywords(query, keywords) {  if (!query) return false;  const lowercaseQuery = query.toLowerCase();  return keywords.some((keyword) =>    lowercaseQuery.includes(keyword.toLowerCase())  );}

Insert the promotional listing when a keyword matches

content/content.js
function addHtmlAsChild(elementId, htmlContent) {  const parentElement = document.getElementById(elementId);  if (parentElement) {    const newElement = document.createElement("div");    newElement.innerHTML = htmlContent;    parentElement.insertAdjacentHTML("afterbegin", htmlContent);  }}function main() {  if (isGoogleSearchResultPage()) {    const query = extractSearchQuery();    const desiredKeywords = [      "website development", "web development", "web design",      "content writing", "seo", "website", "digital marketing",      "digital marketing agency", "website development agency",      "online marketing firm", "web design company",      "internet advertising agency", "seo services",      "social media marketing agency", "ppc management company",      "content marketing firm", "web development services",      "e commerce website development", "digital branding agency",      "sem services", "mobile app development agency",      "digital strategy consulting", "user experience design firm",      "responsive website design", "email marketing services",      "conversion rate optimization", "inbound marketing agency"    ];    if (containsDesiredKeywords(query, desiredKeywords)) {      addHtmlAsChild("topstuff", htmlContent);    }  }}main();
Where the injected result points
    • www.webholix.com

    Receives the click if you follow the injected listing. No user data beyond the click itself was observed leaving the browser toward this host.

What it can do

Permissions this extension asks for, as declared in version 0.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed WhatsApp Privacy Shield contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.webholix.com

    WhatsApp Privacy Shield sends data to www.webholix.com. No other extension we have analysed sends data here.

Updated 30 September 2026onlkfegkceehglppejbjphgkdclgaall