Is Notifier for WhatsApp Web safe?
We analyzed Notifier for WhatsApp Web version 3.0's actual code and gave it a 86/100 trust score. This appears purpose-aligned and reasonably safe, with…
Bottom line
This appears purpose-aligned and reasonably safe, with moderate tab-control access and no evidence of data misuse.
What it can access
It can inspect and manage WhatsApp Web tabs, including closing duplicates, which fits notifications but gives it meaningful control there.[Q1][Q2][Q8]
Security weaknesses
The main weakness is that it may close a duplicate WhatsApp tab and focus another without asking first.[Q8]
Signs of misuse
No evidence shows information leaving the browser, downloaded instructions, or misuse of WhatsApp data.[Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs and scripting plus access to WhatsApp Web; those permissions support its badge and tab management, though they allow high-impact tab operations.
Declares tabs, scripting and a host permission limited to WhatsApp Web. — manifest.json:8-10
Uses those APIs to track/focus/create/close WhatsApp tabs and inject the landing-state check. — background.js:4-19, 35-49
Which websites can it run on, and can it read or change what appears on those pages?
It reads the WhatsApp tab title and checks for one page element, and it can close or focus WhatsApp tabs; it does not inspect chat content.
Injects checkLandingWrapper and parses only a leading unread count from the tab title. — background.js:46-74
Closes duplicate WhatsApp tabs and focuses the existing tab. — background.js:4-15, 77-83
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The only injected page function checks whether .landing-wrapper exists; no input or keyboard access occurs. — background.js:46-75
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads WhatsApp tab URLs and titles to manage the active tab and unread badge, but it does not access cookies, history, bookmarks, storage or downloads.
Checks WhatsApp URLs, parses unread counts from titles and remembers one tab ID only in worker memory. — background.js:4-18, 61-67, 91-109
Cookies, history, bookmarks, storage and downloads permissions are absent. — manifest.json:8-10
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No corresponding device or data permission is declared. — manifest.json:8-10
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
The complete executable code contains no fetch, XHR, beacon, WebSocket or remote endpoint beyond opening WhatsApp Web in a tab. — background.js:1-113
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior and the WhatsApp URL are fixed in the packaged worker. — background.js:1-113
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically closes a newly opened duplicate WhatsApp tab and focuses the first one without a separate confirmation.
On a second WhatsApp tab update, calls tabs.remove on the new tab and activates the remembered tab. — background.js:4-11
Applies the same single-tab policy when a tab is created with a WhatsApp pending URL. — background.js:29-33, 77-83
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings, search or proxy permission exists. — manifest.json:8-10
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
One readable source file contains all executable behavior. — background.js:1-113
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The interval and callbacks use declared functions; no text is converted into code. — background.js:1-113
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Filters tab lifecycle events by the fixed WhatsApp URL and stores only one tab ID in memory. — background.js:4-33
No history permission is requested. — manifest.json:8-10
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No identifier generation, persistence or remote transmission exists. — background.js:1-113
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Page inspection is limited to a boolean landing-wrapper check and local unread-count badge calculation. — background.js:46-75
No cookies permission is declared and no outbound network code exists. — manifest.json:8-10
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The injected function performs one querySelector and returns a boolean. — background.js:46-75
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No content script, externally_connectable rule or external messaging interface is declared. — manifest.json:1-25
Registers browser tab/action events only and no runtime message handler. — background.js:1-113
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injected code only checks for one element and does not modify page content. — background.js:46-75
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission exists. — manifest.json:8-10
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to WhatsApp Web and nativeMessaging is absent. — manifest.json:8-10
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All executable logic is direct, packaged JavaScript. — background.js:1-113
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No web_accessible_resources or externally_connectable declaration is present. — manifest.json:1-25
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on the fixed WhatsApp URL and ordinary tab events. — background.js:1-113
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
A one-second interval retrieves the remembered tab and calls updateBadge. — background.js:91-103
Each update executes one querySelector and reads the cached tab title. — background.js:46-75
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The only injected function reads whether .landing-wrapper exists and makes no DOM change. — background.js:73-75