What our analysis found

Chatweb CRM : Transforme seu whatsapp em um sistema de vend… is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by privilege escalation. It comes from a publisher with 20 extensions and was last updated in October 2026.

Key findings

• High

  Privilege Escalation

  Every port, wherever it came from, is added to the same set `s` with no origin check, and admits [domain withheld], [domain withheld] and the non-production developer host [domain withheld] to onConnectExternal. Registering on onConnectExternal is itself necessary (the in-page bridge at:4296 reaches the worker that way), but because the hub never distinguishes the WhatsApp bridge from a vendor panel, the "WPP-EVENTS" branch here re-broadcasts to those external ports the unsolicited stream that:4532 emits on every inbound message as x("chat.new_message", {data: t[0], msgID, author}) - the whole serialized message object, whose the module itself reads at line 8, plus chat.active_chat and presence changes - and any external port that names itself and sets `sender` can additionally invoke the fixed command table at:4720 (getMessages, getAllUnreadMessages, downloadMedia, getAllGroups, getParticipants, getProfilePictureUrl, sendTxt) and receive the WPP-RESPONSE chunks back through this function's default branch. A CRM overlay needs none of that reach for a dev domain, and the listing's CWS-disclosed data collection is "none declared", so continuous relay of message content and contact identifiers to an external web origin is both undisclosed and a far wider trust boundary than the product requires.

  Show more — Privilege Escalation