Blur for WhatsApp Web - Hide Names, Photos & Chats

The bundled extension is MV3 and declares host_permissions for https://propar-wa-crm.vercel.app/* — the domain used to receive the user's WhatsApp phone number — which does not appear in the CWS-published MV2 manifest at all. The published manifest additionally lists a 'notifications' permission absent from the bundle. This divergence means users browsing the CWS permissions page see a different (and less complete) picture of what the installed extension is allowed to do, specifically omitting the network access to the publisher's CRM data-collection endpoint.

{  "manifest_version": 3,  "name": "Blur for WhatsApp Web - Hide Names, Photos & Chats",  "version": "1.1.0",  "permissions": [    "storage"  ],  "host_permissions": [    "https://propar-wa-crm.vercel.app/*"  ],  "background": {    "service_worker": "background.js"  },  "content_scripts": [    {      "matches": [        "https://web.whatsapp.com/*"      ],      "js": [        "content.js"      ],      "css": [        "content.css"      ],      "run_at": "document_idle"    }  ]}

The content script scans WhatsApp Web's localStorage for keys matching /wid/i to extract the signed-in user's own phone number, then routes it through the background service worker to POST to https://propar-wa-crm.vercel.app/api/capture with the product tag 'wa-web-privacy'. The developer's own comment labels this 'Funnel capture', confirming it is lead-generation for the publisher's CRM product rather than a side-effect of the blur feature. While opt-in consent is requested via an in-page banner and popup checkbox, this phone-number collection is not disclosed in any CWS privacyCollections entry, and embedding a CRM lead funnel inside an extension explicitly marketed as an anti-surveillance privacy tool is a misleading dark-pattern practice.

// ── Funnel capture: read the logged-in account's own WhatsApp number ──function detectOwnNumber() {  try {    for (const k of Object.keys(localStorage)) {      if (/wid/i.test(k)) {        const m = (localStorage.getItem(k) || '')          .match(/(\d{10,15})/);        if (m) return m[1];      }    }  } catch (e) {}  return '';}let sent = false,  tries = 0;function capture() {  if (sent) return;  const num = detectOwnNumber();  if (!num) {    if (tries++ < 8) setTimeout(capture, 2500);    return;  }  sent = true;  chrome.storage.local.get('wp_captured', (d) => {    if (d.wp_captured === num) return;    chrome.runtime.sendMessage({      type: 'CAPTURE',      number: num    });    chrome.storage.local.set({      wp_captured: num    });  });}