[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Contact Saver for WhatsApp

Version 1.2.11 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: watools.im

Rating: 4.9 ★ (992 ratings)

Users: 20,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has a strong user base of 20,000 users with an excellent 4.9-star rating from nearly 1,000 reviews, suggesting positive user experiences. However, the developer "watools.im" lacks clear company information or established reputation, which raises some transparency concerns. The specific focus on WhatsApp contact management appears legitimate given the extension's purpose.

Concerns:

The tabs permission is excessive for a contact saving tool - this allows the extension to monitor and manipulate all browser tabs, not just WhatsApp. While the host permissions are appropriately restricted to WhatsApp domains, the combination of tabs access with scripting capabilities creates potential for broader surveillance beyond the stated functionality. The storage permission, while necessary for saving contacts, could be used to collect and retain user data indefinitely.

Recommendations:

Consider running this extension in a separate Chrome profile to isolate it from your other browsing activities. Before installation, verify that the contact saving functionality truly requires tab-level access by checking if similar extensions operate with more limited permissions. Monitor the extension's behavior after installation and revoke permissions if you notice unexpected tab interactions. Given the high rating and user base, the extension likely functions as advertised, but the excessive permissions warrant caution for privacy-conscious users.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
scripting
tabs

Host Permissions:

*://*.whatsapp.com/*

Embedded URLs (135 total):

https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://github.com/zloirock/core-js/blob/v3.32.1/LICENSE	https://github.com/zloirock/core-js
https://whatsapp.com/channel/	https://www.whatsapp.com/otp/code/?otp_type=COPY_CODE&code=otp
https://wasbb.com/contact-saver-for-whatsapp	https://v1.wasbb.com
https://wasbb.com/feedback?name=contact-saver-for-whatsapp	https://wasbb.com
https://chat.whatsapp.com/	https://cobrancas.uppermesh.com.br:8000
https://wajsapi.titanchat.com.br	https://wppc-linkpreview.cloudtrix.com.br
https://wa.me/c/	https://clients2.google.com/service/update2/crx
https://github.com/adobe/react-spectrum/issues/2320	https://github.com/heroui-inc/heroui/issues/4292
https://zjtlssppxzesxvhwokje.supabase.co	https://developer.mozilla.org/en-US/docs/Web/API/LockManager/request
https://web.whatsapp.com	https://chromewebstore.google.com/detail/
http://sheetjs.com	http://schemas.openxmlformats.org/package/2006/metadata/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/custom-properties	http://schemas.openxmlformats.org/officeDocument/2006/extended-properties
http://schemas.openxmlformats.org/package/2006/content-types	http://schemas.openxmlformats.org/package/2006/relationships
http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments	http://purl.org/dc/elements/1.1/
http://purl.org/dc/terms/	http://purl.org/dc/dcmitype/
http://schemas.openxmlformats.org/officeDocument/2006/relationships	http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes
http://www.w3.org/2001/XMLSchema-instance	http://www.w3.org/2001/XMLSchema
http://schemas.openxmlformats.org/spreadsheetml/2006/main	http://purl.oclc.org/ooxml/spreadsheetml/main
http://schemas.microsoft.com/office/excel/2006/main	http://schemas.microsoft.com/office/excel/2006/2
http://www.w3.org/TR/REC-html40	http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument
http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink	http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath	http://schemas.microsoft.com/office/2006/relationships/xlExternalLinkPath/xlPathMissing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments	http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings	http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles
http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme	http://schemas.openxmlformats.org/officeDocument/2006/relationships/chartsheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet	http://purl.oclc.org/ooxml/officeDocument/relationships/worksheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/dialogsheet	http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet
http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing	http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata
http://schemas.microsoft.com/office/2017/10/relationships/threadedComment	http://schemas.microsoft.com/office/2017/10/relationships/person
http://schemas.microsoft.com/office/2006/relationships/vbaProject	http://docs.oasis-open.org/ns/office/1.2/meta/
http://schemas.openxmlformats.org/drawingml/2006/main	http://schemas.microsoft.com/office/spreadsheetml/2017/richdata
http://schemas.microsoft.com/office/spreadsheetml/2017/dynamicarray	http://openoffice.org/2004/office
http://openoffice.org/2004/writer	http://openoffice.org/2004/calc
http://www.w3.org/2001/xml-events	http://www.w3.org/2002/xforms
http://openoffice.org/2005/report	http://www.w3.org/2003/g/data-view#
http://openoffice.org/2009/table	http://openoffice.org/2010/draw

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0g3N5w0AYb7F1z7WnzcL5nDnFV4gAfA8zuI5/Kjw7SZ/CvNdbC2u2Y59WsrvNEiVodaM2f3+K8NmKw+LzX6izsyysqVjynlFWEH1+h9wuKBEGzELmrHHFqiSvN6gQavA7tr9S8zfRu6mXe8zyTDPpNM16EBwe1a6QTrARjCTwhx8vpcqu6Dko84jvn84V7i8dhmF6w/e/6xJ3lFERPqa4f4cUflZe0jTFupr2kAVzj+UR3Fxz76z05ax9AO3M3L81IgUgboPhniNaITCJsv7QdAOjtifDn7s8zDHGK9kuWh3hsgs62bKo6UfVuX/VSDGY1sSMdP1ZBx0gA6CkIf3LQIDAQAB",
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "icon16.plasmo.6c567d50.png",
    "32": "icon32.plasmo.76b92899.png",
    "48": "icon48.plasmo.aced7582.png",
    "64": "icon64.plasmo.8bb5e6e0.png",
    "128": "icon128.plasmo.3c1ed2d2.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.plasmo.6c567d50.png",
      "32": "icon32.plasmo.76b92899.png",
      "48": "icon48.plasmo.aced7582.png",
      "64": "icon64.plasmo.8bb5e6e0.png",
      "128": "icon128.plasmo.3c1ed2d2.png"
    },
    "default_popup": "popup.html"
  },
  "author": "Plasmo Corp. <foss@plasmo.com>",
  "version": "1.2.11",
  "background": {
    "service_worker": "static/background/index.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "storage",
    "scripting",
    "tabs"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "contents.04ff201a.js"
      ],
      "css": [],
      "matches": [
        "*://*.whatsapp.com/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*.whatsapp.com/*"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "*://*.whatsapp.com/*"
      ],
      "resources": [
        "contents.95bad065.css"
      ]
    }
  ]
}

by ✦ Astarte

Contact Saver for WhatsApp

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (135 total):

Raw Manifest

Detections

Manifest Findings