Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
4 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
WAPlus CRM - Best AI-Powered Messaging CRM, used by 70,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (4 high), led by privilege escalation. Its permissions mean it can inject scripts into pages.
Key findings
- High
Privilege Escalation
Reads the list named "WA competitive product" out of the remotely-fetched `zbaseConfig`, enumerates every installed extension via chrome.management.getAll(), and calls chrome.management.setEnabled(id, false) on each entry marked `isMe:false` that is currently enabled, then reloads WhatsApp Web. Because the list is served from [domain withheld] (:32), the target set can be changed without any Chrome Web Store review, and the selection criterion is commercial rivalry rather than any measured conflict. Silently disabling software the user chose to install is outside any reading of this extension's stated CRM purpose.
- High
Other
The bundled default for the list consumed by `Me()` enumerates 22 unique competing extension IDs by name (Cooby, Eazybe, Whatsup+, WA Filter, WA Group Sender, Easy Sender, multi-chat-messenger and several " 工具" entries; 24 entries in total, one duplicated and one being WAPlus itself at `isMe:true`, the only ID spared). This payload is what makes the disable routine a competitor kill list rather than a conflict resolver, and it directly contradicts the "compatibility issues" justification shown to the user.
- High
Other
The only consent surface for the `management` permission tells the user WAPlus has "identified compatibility issues with your extensions" and offers a "One Click Fix", never disclosing that the action targets a vendor-curated list of named competitors; the grant is therefore obtained under a false technical pretext. The handler behind the button (:283) persists `management:true` to chrome.storage.local and immediately sends `disableExtension`, and a second, no-prompt handler reading the same stored flag exists at:250 (`ge`, registered as `OPEN_DISABLE_EXTENSION`), though no sender for it was found in this build.
- High
Unauthorized Data Collection
`ze()` (message type `getUserExtension`, fired by the moment the "compatibility issue" dialog opens) calls chrome.management.getAll() and uploads the complete installed-extension inventory together with the stored `COOKIE_IDENTITY` to the vendor's Aliyun SLS logstore at [domain withheld] under event 403101, which the extension's own code table at:30 documents as "用户安装的插件以及 cookie" ("the user's installed plugins, and cookie"). The destination is first-party, but a full browser-extension inventory keyed to a session identifier is a device fingerprint with no bearing on running a WhatsApp CRM, and the CWS listing declares no data collection at all, so the category is undisclosed under rule 7e(ii).
Analyst notes
38 `Me()` reads a list from remote config ([domain withheld],:32) whose own name is "WA competitive product" -- 22 unique rival extension IDs (Cooby, Eazybe, WA Filter, Easy Sender, multi-chat-messenger and several " 工具" entries), with WAPlus alone marked `isMe:true` -- then calls chrome.management.setEnabled(id,false) on each one installed, while the only consent surface (:50) attributes the action solely to "compatibility issues with your extensions"; separately:38 `ze()` uploads the full installed-extension inventory plus the stored waplus `_identity` value to the vendor's own Aliyun SLS logstore under event 403101, which their code table labels "用户安装的插件以及 cookie", against a CWS disclosure of "none declared". The ML score is not independently corroborated -- the permhash " malicious" cluster is 97 versions of this same extension all labelled by the single 2026-09-13 malext-feed import, chrome-stats rates likelihood, Google grants the trusted-publisher badge, the manifest matches the published one exactly, and the data flows are the advertised CRM product -- so the independent evidence is the kill list itself, not the scores. I stay below `likely_malicious` because the abuse is anti-competitive sabotage and undisclosed inventory telemetry rather than credential theft or remote code loading, the dialog does warn that some extensions may close and points to chrome://extensions/, `je` is wired only to runtime.onMessage (not onMessageExternal), so a [domain withheld] page cannot invoke `disableExtension` remotely, and I found no trigger for the dialog in this build at all: `SET_OPEN_WPP_DIALOG` is sent only by `Me()` itself when zero rivals are found, and the no-prompt handler `ge` (:250, registered as `OPEN_DISABLE_EXTENSION`) has no sender anywhere in 1.8.17 -- the "WPP load failed" reading rests only on the dialog's internal label. PIPELINE BUG: the review bundle held 11 of 182 signed files and dropped everything over ~385 KB, including all four large scripts, i.e. the entire 24 MB of behavioural code the ML features were computed on; findings come from the full CRX I re-extracted from /[domain withheld], whose is byte-identical to the bundle's. Cleared on inspection: the.br hosts are upstream @ `linkPreviewApiServers` defaults, `requestHotPermission` (*://*/*) gates only the user-initiated integrations, RESPONSE_DATA_LOG_PATHS logs only waplus's own API responses, both createElement("script") sites load runtime-local URLs, and COOKIE_IDENTITY is [domain withheld]'s `_identity` cookie, not a WhatsApp session token.
WAPlus CRM - Best AI-Powered Messaging CRM Chrome extension security report
ID: jmjcgjmipjiklbnfbdclkdikplgajhgc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://waplus.io/
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 4 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
4 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Let WAPlus CRM be your most powerful assistant for WhatsApp marketing & WhatsApp sales, enhanced by the deepseek AI chatbot.
Read the publisher’s full description
WAPlus CRM plugin provides rich customer management features on the WhatsApp web. Whether you are individuals or businesses, it can help achieve marketing automation and service automation, and generating more business opportunities on WhatsApp. Core Features: ● Conversation management: Automatically categorize conversations on the WA web version into different labels, such as unread messages, messages waiting for a reply, messages that require my response, @mentions, helping you quickly find important messages. ● Auto-reply: Configure your own WhatsApp AI chatbot on in just three steps. Training AI chatbot with desired materials or easily set keywords as trigger rules. Integrate deepseek AI chatbot for more efficient message handling and responses. ● Contact card: Use contact cards to quickly record detailed contact information, sales leads, company information, and follow-up records for your customers. ● Conversation Sharing: Share your WhatsApp chat conversations beyond the WhatsApp platform effortlessly. ● WhatsApp Translate: Automatically translate messages or manually translate them with ease. Enhance your conversations by breaking language barriers seamlessly and communicating effortlessly across different languages. ● CRM Integration: Our product offers seamless HubSpot Integration, Salesforce Integration, and Zoho Integration, enabling users to efficiently manage their customer relationships and sales processes directly within WhatsApp. With this integration, users can view and update contact information, create tasks, notes, deals, and tickets within WhatsApp, enhancing productivity and improving customer communication. WAPlus is also a great team collaboration CRM tool that helps you unlock the potential of WhatsApp private domain traffic and efficiently manage you and your team's customer relationships. Product Features: ● Multi-account and automatic session management: With WAPlus CRM + WhatsApp web version, you can easily manage multiple WA accounts and automate session management, providing convenient marketing services for a large number of customers. ● Free basic features: The basic features of WAPlus CRM are sufficient to meet your daily customer management and marketing needs, and these features are completely free! Team Collaboration: ● Progress sharing: Manage customer sales progress through custom labels and share leads with your team. ● Conversation backup: Synchronize conversation records with customers to the team space, even if the conversations are deleted, you can still view the backup records. ● Dashboard: View the current number of customers and follow-up status of your team in graphical form. Disclaimer: WhatsApp is a registered trademark of WhatsApp Inc. in the United States and other countries. WAPlus is an independent project and has no affiliation with WhatsApp official or WhatsApp Inc. Help Center: https://waplus.io/help-center Privacy Policy: https://waplus.io/waplus-private-policy
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
4 high-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in lifestyle/social
- Skype3,000,000 users
- Skype Calling2,000,000 users
- Não Seguidores1,000,000 users
- Google Meet Tweak (Emojis, Text, Cam Effects)900,000 users
- VidyoWebConnector600,000 users