NewsPublished 28 Jun 2026

50 Chrome extensions. One codebase. One backend. One API key.

Source Reddit NetSec

Discussion

A cluster of 50 Chrome extensions, all sharing the same codebase, backend infrastructure, Firebase project, and a hardcoded API key, has been identified. These extensions, collectively installed around 15,500 times, form a white-label WhatsApp CRM platform. The platform replaces WhatsApp Web's Content Security Policy (CSP), maintains persistent communication via Server-Sent Events (SSE) and Firebase Cloud Messaging, and includes voice transcription and backend backup APIs. Multiple privacy policies exist with inconsistent descriptions of the platform and omit several backend communication mechanisms. This raises privacy and security concerns due to centralized control and potential misuse of user data.

r/netsec (opens in a new tab)u/Huge-Skirt-69900 points0 comments

I reverse engineered a white-label WhatsApp CRM platform distributed across 50 Chrome Web Store extensions (~15,500 installs at the time of analysis).

Every analyzed extension shares the same codebase, backend infrastructure, Firebase project, and hardcoded API key.

Highlights:

Replaces WhatsApp Web's CSP
Persistent communication via SSE and Firebase Cloud Messaging
Voice transcription functionality
Backend backup APIs
Operator-configurable webhooks

I also identified multiple privacy policies describing the same platform differently, with several backend communication mechanisms not discussed in the reviewed policies.

Full report, IOCs, and the complete 50-extension cluster:

https://malext.io/reports/WhatsCluster/

Related: WaSteal, my previous research on a different WhatsApp extension ecosystem.

Links cited in the discussion

https://malext.io/reports/WhatsCluster/

Impact

Users of any of the 50 extensions are potentially exposed to privacy risks due to centralized data collection and backend control. The replacement of WhatsApp Web's CSP and persistent communication channels could allow the extensions to intercept or manipulate user interactions with WhatsApp Web. The inconsistent privacy policies indicate that users may not be fully informed about data collection or backend activities. The shared hardcoded API key and backend infrastructure mean that compromise of one component could impact all extensions, amplifying the risk. However, no known exploits in the wild have been reported at this time.

Defensive guidance

Users should consider uninstalling these extensions due to the privacy and security concerns identified. Chrome Web Store administrators and security teams should review and potentially remove or block these extensions. Developers and security teams should monitor for updates or official fixes from the extension maintainers or platform providers.

Summary

The threat involves a network of 50 Chrome extensions distributed via the Chrome Web Store, all operating from a single codebase and backend infrastructure, including a shared Firebase project and a hardcoded API key. This setup enables persistent communication channels and advanced features such as voice transcription and operator-configurable webhooks. The extensions replace WhatsApp Web's CSP, potentially allowing them to bypass standard security restrictions. The presence of multiple, inconsistent privacy policies that fail to disclose all backend communications suggests a lack of transparency and potential privacy violations. The centralized backend and shared API key create a single point of failure or compromise affecting all extensions in the cluster.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 28 Jun 2026, 00:51 UTC

Technical details

References

Community reviews

Related threats